Expel says the campaign uses Microsoft Teams messages to push a fake "PowerShell Cleaner" MSI from Azure, then drops a multi-language toolkit that installs persistence, opens a remote PowerShell shell, and displays a fake Windows 11 lock screen to capture credentials.
Microsoft Teams phishing is no longer just about fake help-desk chatter. In this case, Expel says the operator uses Teams to move the victim into a download flow that looks trustworthy because the MSI is hosted in Microsoft Azure and presented as a fake "PowerShell Cleaner."
What Changed
According to BleepingComputer's write-up of Expel's research, the installer drops a PowerShell script named cleaner.ps1 plus a ZIP archive that contains a Python framework, a malicious Python script, precompiled Python libraries, and fake Microsoft runtime DLLs.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
Expel says SynkLoader stands out because it mixes Python, PowerShell, C#, and C++ across the toolkit, sometimes blending multiple languages inside a single module instead of behaving like a simpler one-stage loader.
What The Malware Actually Does
Expel observed several modules that make the campaign more serious than a one-shot credential phish.
- A persistence module creates a randomly named scheduled task that launches SynkLoader at user logon and again daily at 10 a.m.
- The
PhishLockermodule displays a convincing fake Windows 11 lock screen to steal the user's password. - An interactive shell gives the operator hands-on-keyboard PowerShell execution after the initial compromise.
- A status module reports which malware components and threads are running, which helps the operator keep the infection stable.
Why Teams Delivery Matters
The real lesson is that collaboration platforms now deserve the same delivery-path skepticism defenders already apply to email. If a user can be pushed from a Teams chat into MSI execution and then into a fake lock-screen credential prompt, the failure is spread across messaging controls, endpoint policy, identity awareness, and post-execution detection.
Expel also noted that SynkLoader appears interested in measuring Active Directory environment size, which is a useful clue that the operators may be working toward ransomware-oriented follow-on activity rather than a narrow one-off theft.
What Teams Should Do Next
- Review Teams external access and messaging exposure, especially for users who are likely to trust unsolicited chat-based support requests.
- Hunt for
cleaner.ps1, suspicious MSI launches from chat-delivered downloads, and randomly named scheduled tasks created around initial execution. - Check whether endpoint controls would block or flag a Python-plus-PowerShell loader chain delivered from a trusted cloud host.
- Teach users one practical check from Expel's research: a fake full-screen lock screen may still expose underlying windows with Alt+Tab, which is a strong sign the prompt is malicious.
Source Context
CyberExperts used BleepingComputer as the primary source for this article and kept the details defenders actually need: the fake Azure-hosted MSI, cleaner.ps1, the multi-language loader design, the scheduled-task persistence, the fake lock screen, and the hands-on-keyboard PowerShell access described by Expel.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
