Expel says the campaign uses Microsoft Teams messages to push a fake "PowerShell Cleaner" MSI from Azure, then drops a multi-language toolkit that installs persistence, opens a remote PowerShell shell, and displays a fake Windows 11 lock screen to capture credentials.
Microsoft Teams phishing is no longer just about fake help-desk chatter. In this case, Expel says the operator uses Teams to move the victim into a download flow that looks trustworthy because the MSI is hosted in Microsoft Azure and presented as a fake "PowerShell Cleaner."
What Changed
According to BleepingComputer's write-up of Expel's research, the installer drops a PowerShell script named cleaner.ps1 plus a ZIP archive that contains a Python framework, a malicious Python script, precompiled Python libraries, and fake Microsoft runtime DLLs.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Expel says SynkLoader stands out because it mixes Python, PowerShell, C#, and C++ across the toolkit, sometimes blending multiple languages inside a single module instead of behaving like a simpler one-stage loader.
What The Malware Actually Does
Expel observed several modules that make the campaign more serious than a one-shot credential phish.
- A persistence module creates a randomly named scheduled task that launches SynkLoader at user logon and again daily at 10 a.m.
- The
PhishLockermodule displays a convincing fake Windows 11 lock screen to steal the user's password. - An interactive shell gives the operator hands-on-keyboard PowerShell execution after the initial compromise.
- A status module reports which malware components and threads are running, which helps the operator keep the infection stable.
Why Teams Delivery Matters
The real lesson is that collaboration platforms now deserve the same delivery-path skepticism defenders already apply to email. If a user can be pushed from a Teams chat into MSI execution and then into a fake lock-screen credential prompt, the failure is spread across messaging controls, endpoint policy, identity awareness, and post-execution detection.
Expel also noted that SynkLoader appears interested in measuring Active Directory environment size, which is a useful clue that the operators may be working toward ransomware-oriented follow-on activity rather than a narrow one-off theft.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What Teams Should Do Next
- Review Teams external access and messaging exposure, especially for users who are likely to trust unsolicited chat-based support requests.
- Hunt for
cleaner.ps1, suspicious MSI launches from chat-delivered downloads, and randomly named scheduled tasks created around initial execution. - Check whether endpoint controls would block or flag a Python-plus-PowerShell loader chain delivered from a trusted cloud host.
- Teach users one practical check from Expel's research: a fake full-screen lock screen may still expose underlying windows with Alt+Tab, which is a strong sign the prompt is malicious.
Source Context
CyberExperts used BleepingComputer as the primary source for this article and kept the details defenders actually need: the fake Azure-hosted MSI, cleaner.ps1, the multi-language loader design, the scheduled-task persistence, the fake lock screen, and the hands-on-keyboard PowerShell access described by Expel.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
