New Modular Malware Framework Identified: SynkLoader
Recently, cybersecurity experts unveiled details surrounding a sophisticated new modular malware framework known as SynkLoader. This emerging threat operates seamlessly by integrating multiple programming languages, including Python, C#, C++, and PowerShell, along with memory-resident payloads designed to elude endpoint detection systems effectively.
The malware’s initial distribution is attributed to a phishing scheme executed through Microsoft Teams. In this operation, attackers utilize a convincing fake Windows lock screen interface to trick users into revealing their credentials. Once this information is captured, the malware enables network tunneling and establishes interactive access to compromised enterprise environments.
Analysis of compile timestamps and file metadata suggests that SynkLoader was crafted and deployed around July 28, 2026, indicating a fairly recent emergence in the cybersecurity landscape. The attackers initiate their operations by leveraging social engineering tactics, masquerading as internal IT Service Desk personnel. They contacted potential victims using an email address associated with the company’s default Microsoft 365 tenant domain, specifically an @company.onmicrosoft.com address. This approach adds a layer of credibility to impersonation attempts.
Victims are persuaded to download a malicious MSI package hosted on an Azure Blob Storage endpoint, deceptively named "PowershellCleaner." Upon execution of the package, it creates a ZIP archive along with a PowerShell script located in the %LocalAppData%\PowershellCleaner\script directory. The script employs several advanced techniques to execute subsequent stages entirely in memory. These techniques include hidden PowerShell execution, hex character reconstruction, Base64 encoding, AES-CBC encryption, and the use of the Invoke-Expression command.
Once operational, the malware creates a randomly named 16-character directory under %AppData%, from which it extracts its payload and launches a bundled Python runtime via pythonw.exe. This self-contained Python environment is crucial as it allows SynkLoader to run on systems that do not have a pre-installed Python interpreter, broadening the scope of potential targets.
The main Python component, referred to as ss.py, communicates with several hardcoded command-and-control (C2) domains, including neversoftmain[.]net, rootfarmapp[.]net, and tripinupdate[.]net. The malware beacons back to these servers every 90 to 120 seconds using ChaCha20-encrypted JSON traffic. In an interesting twist, the operators have altered the cipher’s standard Sigma constants, thereby enhancing their evasion tactics. The name of the randomly established installation directory not only serves as an identifier for the victim but also acts as the encryption key for communications.
The architecture of SynkLoader’s C2 framework provides its operators with a potent execution mechanism. It is designed in such a way that it can decrypt server responses and relay them directly to Python’s exec function. This enables arbitrary in-memory execution of Python code without the need to write each subsequent module to disk, thereby reducing the risk of detection.
According to researchers from Expel, the campaign associated with SynkLoader was first detected on August 18 when an endpoint detection and response (EDR) alert flagged a suspicious scheduled task on a customer network. Notably, there were no prior public references to the loader or its various components before this discovery.
The profiling aspect of SynkLoader demonstrates a clear focus on enterprise ecosystems. To facilitate its operations, it uses a malicious DLL named msvcp150.dll, disguised as a Microsoft Visual C++ runtime. This DLL exposes PowerShell execution capabilities to the Python loader, enabling the malware to enumerate critical system details, such as hostname, username, privileges, active processes, services, domain memberships, and the total count of computers in Active Directory.
Embedded debug paths within the code reference a developer account identified as genry, indicating a potential link to the creators of the malware. Researchers managed to simulate the C2 protocol and sent fabricated telemetry depicting an endpoint within a large Active Directory environment. The response was swift; the C2 returned persistence and credential-phishing modules, alongside tools conducive to hands-on-keyboard intrusions.
Interestingly, while the code simulates the Windows 11 lock screen, the analysis system it ran on was Windows 10, indicating possible adjustments aimed at deceiving target victims based on their system environment.
To ensure persistent access, the malware employs a fake runtime DLL, msvcp160.dll, which manually maps native DLLs into memory. This payload generates a randomly named scheduled task through the Windows Task Scheduler COM interface, rather than utilizing schtasks.exe. This method substantially reduces command-line telemetry, further minimizing the chances of being detected by behavioral rules. The scheduled task is configured to relaunch the Python loader upon user logon and every day at 10 a.m.
Among the more distinctive payloads is a module dubbed “PhishLocker.” This feature presents users with a full-screen graphical interface designed to closely resemble the Windows lock screen. It retrieves the current username and local background imagery to create a deceptive password prompt aimed at harvesting plaintext passwords. Although users may technically bypass this fake screen by entering any value, its visual authenticity poses a significant risk for credential capture.
Unlike traditional credential dumping tools like Mimikatz, this technique seeks to capture raw passwords rather than NTLM hashes. This distinction holds considerable importance in Single Sign-On (SSO) environments, where a valid password can unlock access to various services, including VPNs, Software as a Service (SaaS) applications, internal systems, email platforms, and privileged accounts.
Additionally, SynkLoader integrates a “TrafficRedirector” module, a reverse proxy that establishes outbound connections to the attacker’s infrastructure. This module forwards traffic to both internal resources and external destinations selected by the operators. Coupled with the harvested credentials, it provides attackers a means to access local area network (LAN) services, effectively bypassing IP-based allow-listing controls by operating under the victim’s corporate network credentials.
The arsenal also includes an in-memory PowerShell reverse shell along with a Python component known as “StreamMaster,” capable of streaming the victim’s active desktop and injecting keyboard or mouse events. This toolkit marks a significant shift from automated foothold strategies to direct operator-driven intrusions.
To mitigate the risks posed by SynkLoader, cybersecurity defenders are encouraged to scrutinize software downloads originating from Teams, monitor for unexpected bundled Python runtimes, examine suspicious executions of pythonw.exe from the AppData directory, and investigate scheduled tasks with randomized naming conventions. Network teams should also proactively block or investigate traffic associated with the identified C2 domains and review outbound traffic linked to the described encrypted beacon patterns.
Given the evolving landscape of malware threats exemplified by SynkLoader, it is crucial for organizations to remain vigilant and implement robust security measures to protect their digital environments.