# SynkLoader: The Malware That Weaponizes Microsoft's Own Infrastructure Against You
When Marcus Hutchins — the researcher who accidentally stopped WannaCry in 2017 by registering a sinkhole domain — flags something as worth watching, you pay attention. Last week, Hutchins and his team at Expel published findings on a freshly minted malware family they're calling SynkLoader. It's been active for less than a month. And it's already more sophisticated than most tools defenders will see this year.
The name is a nod to its philosophy: throw everything but the kitchen sink at getting inside a network. But the cleverness isn't in the volume of tricks — it's in the specific combination, and in how thoroughly the operators have studied what actually works in 2026.
## The Lure That Looks Exactly Right
The attack chain that Expel documented began with a phishing email. Not a typosquatted domain, not a free Gmail account, not the kind of garbage your spam filter catches before breakfast. The attackers registered their own legitimate Microsoft 365 tenant and sent from an onmicrosoft.com address — Microsoft's own default domain structure, assigned to any organization that signs up for M365.
The email identified itself as the victim's IT Service Desk.
This is worth sitting with. Most employees who've been through security awareness training are told to check sender domains. An @onmicrosoft.com address passes that test. It looks like an internal-ish Microsoft communication. And the payload — a fake PowerShell system maintenance tool — was hosted not on some sketchy file-sharing site but on an official Microsoft Azure storage page.
The attackers didn't phish around the brand. They *used* the brand. Microsoft's infrastructure served as both the delivery vehicle and the credibility signal. That's a meaningful evolution from the template-and-hope approach that still dominates commodity phishing.
## What SynkLoader Actually Does
Once the installer runs, it deploys a cascade of components: a PowerShell script executing instructions in volatile memory (no disk writes, nothing for endpoint scanners to grab), a stripped-down Python environment, and a malicious Python script that beacons home. The in-memory execution approach isn't new — living-off-the-land techniques have been standard for years — but SynkLoader layers it with something that hasn't been common for a while: screen hijacking.
Screen hijacking was a staple of early banking trojans in the 2010s. The malware intercepts what's rendered on screen, overlaying fake login prompts or capturing credentials before they hit the legitimate application. It fell out of fashion partly because modern browsers and endpoint controls made it harder to execute cleanly. SynkLoader brings it back, tuned for credential theft in corporate environments where users are authenticating to business applications all day.
The malware is also multilingual — written across multiple programming languages, which complicates analysis. Defenders reverse-engineering a piece of malware typically build expertise in one environment. SynkLoader forces analysts to context-switch, and it suggests a development team with real breadth.
Compilation metadata puts SynkLoader's birth around July 28. Expel found it in a client's network on August 18. The gap between those dates — three weeks — is short enough that there's a real chance this tool hasn't been fully deployed yet. The incident Expel documented may have been an early operational test.
## The Ransomware Prequel Theory
Here's the part that elevates this from "interesting new malware" to "something defenders should act on now."
Expel's researchers found code artifacts suggesting SynkLoader was built either by a ransomware group or an initial access broker — the criminal specialty that breaks into networks and sells that access to ransomware operators. IABs typically want tools that can establish quiet, persistent footholds that survive long enough to be sold. SynkLoader's in-memory execution and scheduled task persistence fit that profile.
If that read is correct, then SynkLoader's victims in the coming months won't know they've been compromised until they see a ransom note. The malware's job isn't disruption — it's durable, invisible presence. The screen hijacking collects credentials. The beaconing gives the operator a live connection. Then, at some point decided by whoever bought the access, the ransomware drops.
The sophistication of the initial access stage tends to correlate with the sophistication of the eventual attack. SynkLoader's operators are not amateurs.
## HackWire Analysis
The SynkLoader discovery lands at a moment when the IAB economy is maturing in uncomfortable ways. For most of the past five years, initial access brokers operated as a relatively commoditized layer — selling corporate VPN credentials or RDP access harvested through opportunistic credential stuffing. The buyers, ransomware groups, provided the operational complexity.
What SynkLoader suggests is that the front end of that supply chain is upgrading. If this tool does belong to an IAB (or a ransomware group building its own access arm), it represents a meaningful jump: custom tooling, infrastructure discipline, social engineering that genuinely exploits enterprise trust in Microsoft's brand, and evasion techniques designed specifically to frustrate modern endpoint detection.
The screen hijacking detail deserves more attention than it's getting. Most current EDR solutions are tuned to catch the patterns of 2022-2024 commodity malware. Resurrected techniques from earlier eras sometimes slip through simply because detection rules weren't written to catch them. That's not a theoretical risk — it's a documented gap that threat actors have exploited before (see the Emotet operators' decision to revive Word macro delivery right after defenders got comfortable assuming nobody still opened macro-enabled documents).
For defenders, the immediate priorities are: review your M365 tenant security policies and ensure you have controls around onmicrosoft.com impersonation of internal service desks (user education alone won't cut it — build detection rules), audit Azure Blob Storage as a delivery vector in your proxy logs, and check whether your EDR coverage actually catches in-memory PowerShell with Python injection. If you haven't tested that chain specifically, assume the answer is "not reliably."
The three weeks between SynkLoader's compilation and its first confirmed detection should be the number that keeps your SOC team up. For every incident Expel caught, count on several that nobody found.
— HackWire Editorial
## Related Coverage