Loading story…
Threat actors are using Microsoft Teams external chats to impersonate internal IT help-desk staff, persuading employees to install malware or grant remote access. The campaign relies on attacker-controlled Microsoft 365 tenants and trusted-looking display names such as “IT Service Desk,” exploiting permissive cross-tenant communication rather than a Microsoft Teams software vulnerability.
One reported operation delivered SynkLoader through a malicious MSI sent in a Teams phishing message. SynkLoader establishes persistence through scheduled tasks and deploys a PhishLocker component that displays a counterfeit Windows lock screen to capture plaintext credentials. Organizations should limit Teams external communications to trusted domains, ensure external-sender indicators are visible, and require employees to independently verify unsolicited support contacts.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Threat actors used external Microsoft Teams chats from attacker-controlled Microsoft 365 tenants to impersonate IT help-desk staff and persuade targets to install a malicious MSI or grant remote access. A reported SynkLoader campaign used the PhishLocker module to show a counterfeit Windows lock screen and capture entered passwords in plaintext.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly identified modular malware family dubbed **SynkLoader** is being deployed through Microsoft Teams phishing messages that impersonate corporate IT help desks and direct users to install a fake "PowerShell Cleaner" MSI hosted on Azure Blob Storage. Researchers found the infection chain uses in-memory PowerShell execution and a bundled Python runtime to launch a multi-language framework spanning **PowerShell, Python, C#, and native C/C++ DLLs**, allowing the malware to remain largely memory-resident while profiling infected systems and establishing persistence through a scheduled task created via COM. SynkLoader supports credential theft and hands-on-keyboard intrusion through several modules, including a fake Windows lock screen component known as **PhishLocker** that captures user passwords, traffic tunneling through the victim host, interactive PowerShell access, and VNC-style desktop streaming for remote control. By emulating the malware's command-and-control protocol and supplying decoy enterprise telemetry, researchers observed operators deploy additional tooling and conduct Active Directory-focused reconnaissance, leading to a low-to-medium confidence assessment that the activity is tied to a ransomware group or an initial access broker supporting ransomware operations.
Aug 28, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Threat actors are increasingly abusing workplace collaboration platforms, especially **Microsoft Teams**, to impersonate IT staff, vendors, and support personnel in social-engineering attacks that bypass user trust controls. Palo Alto Networks Unit 42 reported that collaboration-tool phishing accounted for **42%** of all phishing alerts seen in Cortex during the first four months of 2026, up from **30%** in the prior four-month period, showing a broader shift away from traditional email lures. The attacks commonly pressure users to approve multifactor authentication prompts or otherwise grant access, and researchers said both criminal and nation-state actors are using the technique. Cyfirma separately identified an active Teams-themed campaign that uses fake meeting transcript and recording notifications to lure victims to counterfeit landing pages hosted on compromised websites and attacker-controlled cloud infrastructure, including Cloudflare Workers and Pages. Victims are served a signed Windows installer that silently deploys a legitimate remote monitoring and management tool connected to attacker relay servers, then establishes persistence through a Windows service and registry changes, including mechanisms that survive Safe Mode with Networking. The intrusion chain also includes anti-analysis checks and credential theft via a credential provider DLL and an LSA authentication package, indicating the campaign is designed to convert a trusted collaboration message into durable unauthorized access.
Jun 29, 2026