A newly discovered malware family named SynkLoader is targeting corporate environments through deceptive Microsoft Teams messages. Attackers are posing as internal IT help desk staff to trick employees into installing a malicious file, a tactic that cybersecurity firm Expel says leads to the deployment of a highly convincing fake Windows lock screen designed to steal login credentials. The phishing messages direct victims to download an installer disguised as a "PowerShell Cleaner" update. Because the attackers host this executable (.MSI) file on Microsoft Azure, the download link often bypasses basic security filters and appears legitimate to unsuspecting employees. According to Microsoft, this strategy of abusing trusted cloud infrastructure and internal communication tools has grown increasingly common in multi-stage corporate attacks this year. Once the victim runs the installer, it extracts a PowerShell script and a compressed archive containing a Python framework, malicious scripts, and several fake Microsoft runtime files. Security researchers named the malware SynkLoader due to its unusual structure. It aggressively mixes code from Python, PowerShell, C#, and C++, sometimes combining up to three different programming languages within a single operational module. The attackers then deploy specific modules based on the profile of the breached network, with file timestamps indicating the tools were first compiled around July 28, 2026. The most notable component of the SynkLoader toolkit is a module called PhishLocker. This tool generates a fake lock screen that closely mimics the standard Windows login prompt to capture the user's password. While visually accurate, Expel researchers note that the screen is simply a full-screen, borderless application. Users can easily expose the deception by pressing Alt+Tab, which reveals the active windows running behind the fake prompt, or by using the standard Ctrl+Alt+Delete shortcut. Expel researcher Marcus Hutchins noted that the malware specifically attempts to measure the size of a target's Active Directory environment, strongly suggesting it is a precursor to ransomware deployment. To observe the attackers directly, Expel engineers built an emulator for SynkLoader's reverse shell module. Hutchins confirmed that a live operator connected to the session and attempted to run network profiling commands before realizing they were in a simulated environment and cutting the connection. While Expel has released indicators of compromise, the firm warns that SynkLoader generates unique file hashes for every infection, making traditional signature-based detection difficult. The most effective defense remains independent verification of all IT requests and refusing unsolicited MSI downloads. Broader industry data reflects the scale of these threats; the recently published Blue Report 2026, which measured defensive techniques across 338 million simulations in production environments, notes the challenge of catching these targeted evasion tactics. As corporate offices in Mogadishu, Hargeisa, and across the diaspora increasingly rely on Microsoft Teams for daily operations, their employees face direct exposure to these social engineering attacks. Office workers in these regions must use alternative communication channels, such as a direct phone call to their actual IT department, to verify any sudden internal request to download security updates or software cleaners.