Threat Overview
SynkLoader is a newly documented modular Windows malware family distributed through social engineering that impersonates corporate IT support. Expel observed attackers using Microsoft-controlled infrastructure, including an onmicrosoft.com tenant and Azure-hosted payload delivery, to make the lure appear legitimate.
The malware uses an unusual bundled Python runtime, memory-resident components, scheduled-task persistence, desktop control, a reverse proxy, and a fake Windows lock screen (“PhishLocker”) designed to capture the user’s Windows password. Researchers assess that the tooling could support initial-access brokerage or ransomware operations, but final operator intent is not confirmed.
References
Impacted Systems
| Platform | Windows endpoints |
| Delivery | Microsoft Teams / Microsoft 365-themed IT-support impersonation |
| Payload delivery | Malicious installer presented as a maintenance or PowerShell Cleaner utility; observed Azure hosting |
| Execution | PowerShell plus a bundled/minimal Python environment and memory-resident modules |
| Credential access | Fake Windows lock screen captures the user’s Windows password |
| Persistence | Recurring scheduled task via COM |
| Network capabilities | C2 beaconing, remote shell/desktop control, reverse proxy/tunneling |
| Affected versions | Not version-specific; requires user execution |
What this hunt looks for
Looks for the SynkLoader execution pattern: unusual Python runtimes in user-writable paths, suspicious PowerShell or cleaner.ps1 activity, and outbound communications from those Python processes.
Required logs
DeviceProcessEvents and DeviceNetworkEvents from Microsoft Defender for Endpoint / Defender XDR data available in Microsoft Sentinel.
First-Pass — Python Running From Unusual User-Writable Paths
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("python.exe","pythonw.exe")
| where FolderPath has_any (@"\AppData\", @"\Temp\", @"\Downloads\", @"\ProgramData\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascFollow-Up — Suspicious PowerShell Followed by Python
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("powershell.exe","pwsh.exe","python.exe","pythonw.exe")
| where ProcessCommandLine has_any ("cleaner.ps1","PowerShell Cleaner",@"\AppData\",@"\Temp\") or InitiatingProcessCommandLine has_any ("cleaner.ps1","PowerShell Cleaner")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascFollow-Up — Network Connections From User-Writable Python
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("python.exe","pythonw.exe")
| where InitiatingProcessFolderPath has_any (@"\AppData\",@"\Temp\",@"\Downloads\",@"\ProgramData\")
| where RemoteIPType == "Public"
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP,20), RemoteUrls=make_set(RemoteUrl,20) by DeviceName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| sort by Connections asc
Killian Sherer 