[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPJgL6thYPG3oVMp_ucSPn4W56QNkFo3JJVplv0bjIlA":3},{"article":4,"iocs":54,"watch_terms":77,"solutions":78,"lesson":168},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8b9c3d8f-c525-460c-ae56-4fa1134d6451","New SynkLoader malware pushed in Microsoft Teams phishing campaign","new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign-e9e0ee","A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]","A new malware family named SynkLoader is being distributed through phishing campaigns on Microsoft Teams, impersonating IT help desks. The malware, which uses a mix of Python, PowerShell, C#, and C++, deploys modules to steal system information, establish persistence, capture user passwords via a fake lock screen, and provide remote access.","New SynkLoader malware distributed via Microsoft Teams phishing campaigns steals credentials.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F19\u002Fbox.jpg","2026-08-21T18:01:30+00:00","2026-08-21T20:00:21.223639+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"PowerShell Cleaner",{"name":23,"type":19},"Azure",{"name":25,"type":26},"Python","technology",{"name":28,"type":26},"PowerShell",{"name":30,"type":26},"C#","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65,68,71,74],{"type":35,"value":56,"context":57},"SynkLoader","New malware family identified.",{"type":59,"value":60,"context":61},"mitre_attack","T1059.001","PowerShell script execution (cleaner.ps1).",{"type":59,"value":63,"context":64},"T1059.003","Python script execution.",{"type":59,"value":66,"context":67},"T1547.001","Scheduled task for persistence.",{"type":59,"value":69,"context":70},"T1078.002","Valid accounts (password theft via PhishLocker).",{"type":59,"value":72,"context":73},"T1090.002","Reverse proxy for internal access.",{"type":59,"value":75,"context":76},"T1082","System information profiling.",[18,21,23],{"controls":79,"vendors":167},[80,109,138],{"slug":81,"name":82,"problem":83,"products":84},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":139,"name":140,"problem":141,"products":142},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":169,"title":170,"body":171,"framework_refs":172,"framework_notes":184},"synkloader-malware-spread-via-fake-it-help-desk-on-microsoft-teams","SynkLoader Malware Spread via Fake IT Help Desk on Microsoft Teams","Attackers are impersonating IT help desk staff on Microsoft Teams to trick employees into installing SynkLoader, a multi-stage malware capable of credential theft, persistence, and remote access. The root cause is insufficient user awareness around social engineering attacks delivered through collaboration platforms, which are increasingly trusted and therefore exploited. Because Teams is perceived as an internal, trusted channel, users are less likely to scrutinize requests made through it compared to email phishing. This matters because a successful infection grants attackers persistent, remote control over endpoints along with harvested credentials, enabling lateral movement and data exfiltration.",[173,174,175,176,177,178,179,180,181,182,183],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AT-2 (Security Awareness Training)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","MITRE ATT&CK T1566.003 (Phishing via Third-Party Services)","MITRE ATT&CK T1056.002 (GUI Input Capture – Credential Harvesting)","GDPR Article 32 (Security of Processing)",{}]