Microsoft Teams Phished

Overview

A new phishing campaign targeting Microsoft Teams is delivering a malware family called SynkLoader, designed to steal Windows passwords and provide attackers with persistent access to corporate networks. The campaign relies on IT helpdesk impersonation, tricking employees into installing what appears to be a legitimate fix.

Infection Chain

• Helpdesk impersonation: Attackers pose as IT staff using company.onmicrosoft.com addresses.
• Malicious MSI installer: Victims are persuaded to download an MSI file hosted on Azure Blob Storage, lending credibility.
• PowerShell Cleaner disguise: The MSI unpacks a ZIP archive and PowerShell script into the local app‑data folder.
• In‑memory execution: Hidden PowerShell commands launch a Python‑based loader, minimizing disk activity.
• Scheduled task persistence: A random‑named task runs at logon and at 10 a.m., restoring the loader after restarts.

SynkLoader Capabilities

• System reconnaissance: Collects computer name, username, privilege level, processes, services, and Active Directory details.
• C2 beaconing: Rotates among three domains, checking in every 90–120 seconds, executing Python code returned by the server.
• PhishLocker module: Mimics the Windows lock screen to capture raw passwords. Unlike hashes, these credentials can be reused across single sign‑on services.
• TrafficRedirector module: Acts as a reverse proxy, allowing attackers to access internal services or external sites using the victim’s corporate IP.
• Remote access modules: Includes a remote PowerShell shell and VNC‑based remote control.

Why It’s Dangerous

• Password theft: Captured raw credentials enable attackers to move laterally across corporate networks.
• Stealth persistence: Scheduled tasks and in‑memory execution reduce detection chances.
• Network proxying: TrafficRedirector makes malicious activity appear as legitimate corporate traffic.

Defensive Guidance

Security teams should:

• Verify support requests: Employees must confirm IT messages through official channels.
• Investigate MSI downloads: Block or review MSI files from external sources.
• Monitor PowerShell activity: Look for suspicious in‑memory execution.
• Check scheduled tasks: Identify random‑named tasks with logon triggers.
• Inspect C2 traffic: Block or closely monitor traffic to domains like neversoftmain.net, rootfarmapp.net, and tripinupdate.net.
• Preserve Teams audit logs: Essential for tracing phishing attempts.

Expert in the Cloud Insight

SynkLoader demonstrates how trusted collaboration platforms like Teams can be weaponized. By combining social engineering, in‑memory loaders, and fake lock screens, attackers bypass traditional defenses and harvest credentials directly. The lesson is clear: identity verification and strict monitoring of external Teams communications are critical to preventing corporate breaches.