New Malware Targets Microsoft Teams Users by Posing as Your Company's IT Helpdesk

New malware targets Microsoft Teams users by posing as your company's IT helpdesk

Expel researchers warn of SynkLoader backdoor spread via fake IT help desk Teams messagesMalware modules include PhishLocker (fake login screen harvesting OS passwords) and Interactive Shell for remote controlDefenses: distrust unsolicited Teams DMs, verify with IT before installing apps, and train staff against social engineeringFor roughly a month now, cybercriminals have been targeting organizations with a new backdoor malware called SynkLoad…

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)

Microsoft Teams Phishing Deploys New SynkLoader Malware to Steal Windows Passwords

Microsoft Teams phishing is again being used as a doorway to deliver a malware family called SynkLoader. The campaign relies on a familiar social-engineering trick: an attacker poses as an IT helpdesk worker and persuades an employee to install what appears to be a useful fix. It deploys a layered toolkit that hides much of its activity in memory, gathers details about the victim’s Windows system, and maintains a channel back to the operators. T…

New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks

SynkLoader, a newly identified modular malware framework that combines Python, C#, C++, PowerShell, and memory-resident payloads to evade endpoint detection. Delivered through Microsoft Teams phishing, the operation uses a convincing fake Windows lock screen to capture credentials before enabling network tunneling and interactive access to compromised enterprise environments. Compile timestamps and file metadata indicate the […] This article has…