New malware campaign impersonates IT helpdesk to target Microsoft Teams users

How attackers bypass security awareness training

A recent cybersecurity threat has emerged where attackers are sending deceptive messages through Microsoft Teams, pretending to be from a company's internal IT helpdesk. The campaign, identified by researchers at Expel, began spreading in late August 2026 and aims to trick employees into installing malicious software under the guise of a system cleanup tool. Victims receive messages that appear legitimate, urging them to download a fake cleaner application to resolve non-existent performance issues.

The malware, dubbed SynkLoader, functions as a backdoor that grants attackers remote access to infected systems once installed. It is delivered via a file that mimics legitimate IT utilities, often named to resemble common cleanup or optimization tools. Once executed, SynkLoader establishes communication with attacker-controlled servers, enabling data theft, further malware deployment, or lateral movement within a network. Researchers note that the use of Teams as a delivery vector exploits the trust users place in internal communications, making social engineering particularly effective in this campaign.

What should companies do to defend against such threats

The success of this tactic relies on psychological manipulation rather than technical sophistication. By impersonating trusted IT personnel, attackers reduce skepticism and increase compliance with requests to install software. Many organizations train employees to recognize phishing emails but may overlook similar risks in collaboration platforms like Teams. Expel researchers observed that the messages often include urgent language, such as warnings about system slowdowns or security risks, to prompt immediate action without verification. This urgency overrides standard caution, especially among less technical staff who may not question internal IT directives.

Defending against this type of attack requires a combination of technical controls and updated user education. Organizations should enforce strict application control policies, blocking unauthorized software installations regardless of the source. Monitoring for unusual outbound connections from endpoints can help detect SynkLoader activity after compromise. Additionally, security teams must update awareness programs to include collaboration tools, teaching users to verify unexpected IT requests through secondary channels like phone calls or official ticketing systems. Regular simulation exercises that include Teams-based scenarios can improve resilience against evolving social engineering techniques.

How can users verify if a Teams message from IT is legitimate? Users should contact their IT department through a known, official channel—such as a phone call or internal ticketing system—before acting on any request to install software or share credentials.

Frequently Asked Questions

What signs indicate a potential SynkLoader infection? Unexplained network traffic to unfamiliar domains, unexpected system slowdowns, or the presence of unfamiliar processes in task manager may suggest compromise, though detection often requires specialized security tools.

Is Microsoft Teams itself vulnerable to this malware? No, Teams is not compromised; attackers are abusing the platform as a communication channel to deliver malicious files, similar to how email is used in phishing attacks.