SynkLoader arrives by Teams help-desk chat and an Azure MSI, so the mail gateway sees nothing

The reusable detection surface here is a sequence of process events, not a file. The MSI pulled from Azure extracts a PowerShell script called cleaner.ps1 plus a ZIP containing a Python framework, precompiled Python libraries, a malicious Python script and several DLLs posing as Microsoft runtimes ^[5]. Process lineage catches that shape whether or not anyone holds the hashes, which is fortunate, because Expel's own caveat is that the module hashes are unique per infection and therefore of little use to defenders ^[20]. A published module hash from this family matches the one infection it was taken from and nothing else ^[4].

The persistence module tells the same story at smaller scale. It writes a randomly named scheduled task that fires at user logon and again daily at 10 a.m. ^[10]. The name is unmatchable by design. The pair of triggers is not, and a 10 a.m. task created by a Python process is a query somebody can actually write.

The password capture is what makes the rest worth building. PhishLocker paints a fake Windows lock screen to harvest the account password ^[11], and the TrafficRedirector module stands up a reverse proxy into internal services ^[12]. Expel's assessment is that the two together let the operator reach corporate environments from the infected device, past IP allow-listing ^[16]. The lock screen is a full-screen borderless GUI application, so Alt+Tab exposes the real windows behind it ^[17], and Expel's advice for an unexpected lock screen is Ctrl+Alt+Delete or Alt+Tab ^[21].

Expel wrote an emulator for the reverse shell module and watched an operator run profiling commands before disconnecting once it became clear the environment was not real ^[19]. Marcus Hutchins reads the family's interest in sizing Active Directory as a sign it is used in ransomware operations ^[18]; the System Profiler module does collect the Active Directory computer count alongside privilege level, running services and domain details ^[9]. Which modules land at all is decided after entry, from the environment profile and the operator's targets ^[6].

Four languages appear across the family, with as many as three inside a single module ^[7][2]. That is mostly an analyst tax, though it also means detection content written against one interpreter will only ever see part of the same intrusion.

None of the documented delivery stages involve email ^[3]. It opens in a Teams conversation with somebody claiming to be the target company's own IT help desk ^[1][2], a tactic Microsoft flagged earlier this year as increasingly common in multi-stage attacks ^[2], and the installer is served from Azure, which Hutchins notes makes the download look trustworthy ^[3].