NEW SYNKLOADER MALWARE PUSHED IN MICROSOFT TEAMS PHISHING CAMPAIGNS

Summary from the TLDR InfoSec newsletter

Security researchers from Expel have discovered a previously unknown malware family which it dubbed SynkLoader and is being distributed via Microsoft Teams phishing campaigns. The attack directs victims to install a fake PowerShell Cleaner executable that is hosted in Azure to provide authenticity. The malware allows the attackers to select between modules to deploy: system profiler, persistence module, PhishLocker, which displays a fake Windows login screen to capture Windows account passwords, TrafficRedirector, which allows attackers to reach internal services, a RAT, a VNC, and a module status script.