SynkLoader malware is pushed through Microsoft Teams IT-help-desk phishing

Marcus Hutchins at Expel described a Teams campaign impersonating IT help desk and delivering a fake PowerShell Cleaner MSI hosted on Azure. The loader, first built around July 28, 2026, can drop PhishLocker, a fake lock screen that Alt+Tab reveals as a borderless app.

Image published with BleepingComputer on the SynkLoader Teams phishing campaign

On August 21 BleepingComputer reported a Microsoft Teams phishing campaign documented by Marcus Hutchins at Expel. Messages impersonated IT help desk and pushed a fake PowerShell Cleaner installer hosted on Azure.

What we know

Marcus Hutchins at Expel described Teams phishing that impersonates IT help desk and delivers a fake PowerShell Cleaner MSI hosted on Azure.
The malware was first built around July 28, 2026, and uses Python, PowerShell, C#, and C++.
PhishLocker presents a fake lock screen; Alt+Tab exposes it as a borderless app.
The profiles of Active Directory size were consistent with ransomware staging.

Takeaways

The initial access path is a Teams message that looks like internal IT support.
PhishLocker’s fake lock screen fails a simple Alt+Tab check.
AD sizing in the campaign fits a ransomware-staging profile.

Source: BleepingComputer

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 21, 20263 min read

SynkLoader malware is pushed through Microsoft Teams IT-help-desk phishing

What we know

Marcus Hutchins at Expel described Teams phishing that impersonates IT help desk and delivers a fake PowerShell Cleaner MSI hosted on Azure.
The malware was first built around July 28, 2026, and uses Python, PowerShell, C#, and C++.
PhishLocker presents a fake lock screen; Alt+Tab exposes it as a borderless app.
The profiles of Active Directory size were consistent with ransomware staging.

Takeaways

The initial access path is a Teams message that looks like internal IT support.
PhishLocker’s fake lock screen fails a simple Alt+Tab check.
AD sizing in the campaign fits a ransomware-staging profile.

Source: BleepingComputer