SynkLoader: the Teams help-desk lure now ships with a reverse proxy attached

Expel lists the preconditions for this chain plainly, and not one of them is a software flaw: the user has to run the MSI, PowerShell and Python and COM task creation have to be unblocked, the user has to type a valid Windows password into the fake lock screen, and C2 delivery has to succeed ^[12]. There are no CVEs in the writeup and no attributed group ^[16]. Everything that makes SynkLoader work is a configuration somebody chose, or declined to make.

The traffic side is not quiet if you measure it. A beacon with 90 to 120 second jitter ^[11] works out to roughly 720 to 960 callbacks per device per day ^[20]. It survives on destination rather than volume, and one of the three domains Expel names is tripinupdate.net, which is the shape of a string a network reviewer skims past ^[10].

Module delivery is selective, from multiple C2 servers ^[9]. Two infected hosts in the same organisation need not be carrying the same payloads, so a sweep for the PhishLocker fake lock screen ^[6] can come back clean on a machine that is already relaying traffic outward ^[7]. The stage common to every variant is the cheaper thing to hunt: a randomly named 12-character scheduled task, created through COM, running ss.py under pythonw.exe at logon and again at 10:00 each day ^[5].

The relay is also why a password reset does not close the ticket. Expel's response sequence puts credential rotation and session revocation alongside cross-checking internal and external authentication from the victim's IP address, investigating the PowerShell and VNC activity that follows the proxy, and hunting for other users contacted by the same external tenant ^[15]. That last step is the one that decides whether this was one employee or a mailbox-wide sweep of the org.

Of the four mitigations listed, three are blocks applied after the lure lands: MSI execution, Azure Blob downloads and obfuscated PowerShell; COM Task Scheduler creation; C2 and reverse proxy egress ^[14]. Only restricting external-tenant Teams contact acts before msiexec runs ^[14], and Expel points the detection work at Teams audit logs rather than email ^[13], which is a different log source with a different owner in most shops.

Read the confidence ladder in the report before you escalate: it separates an external Teams contact or MSI URL with no execution from confirmed user action, confirmed loader and task creation, and confirmed post-compromise proxy and VNC activity ^[17]. That distinction is doing real work here, because the first rung will be the most common finding and the cheapest to close. One caveat on sourcing: this account is a dev.to summary crediting Expel as the original ^[18], with a second writeup listed alongside it on the same campaign ^[19] rather than an independent confirmation of the artefacts.