Researchers found a new toolkit that displays a convincing replica of the Windows sign-in screen and refuses to close until the user enters their password.

 

What happened

A malware family called SynkLoader surfaced on a corporate network on August 18, 2026. Build data suggests it was first deployed on July 28, Dark Reading reported. Researchers found evidence pointing toward a ransomware group or an initial access broker. The attack began with a phishing email, but the sender was harder to spot than usual. Instead of registering a lookalike domain, the attackers created their own Microsoft 365 tenant. They then sent the email from Microsoft's default onmicrosoft.com domain, posing as the recipient's IT Service Desk and asking them to install a PowerShell maintenance tool. The installer was also hosted on a genuine Microsoft Azure storage page. To the recipient, both the sender and download location appeared legitimate.

 

Going deeper

The package contains a PowerShell script that runs in memory, a stripped-down Python environment, a Python script that communicates with attacker-controlled servers, and files disguised as Microsoft runtime components. The attackers also used Python, which is relatively uncommon in malware. That can make it harder for endpoint security tools to identify suspicious behaviour. Python could not perform all the actions the attackers wanted, so they bundled components that interact directly with Windows functions. The malicious activity could then run inside a normal Python process. Researchers noted that the setup still gives defenders something to look for. A legitimate Python installation would normally sit in a fixed location or a developer's project folder, rather than a random directory inside application data. A profiling module collects running processes, the user's privileges, the Windows domain name, and a count of how many computers are on the network.

 

What was said

Measuring the size of a victim's network is "typically something only of interest to ransom groups," researchers told Dark Reading, explaining that a state-sponsored group already knows the organization it targeted while an opportunistic criminal needs to work out what they have reached. They described the toolkit's persistence method as deliberately quiet, since it creates its recurring Windows task by calling an internal Windows programming interface rather than through the command line, which is the route security software watches.

 

In the know

The most unusual component revives a technique that largely disappeared about a decade ago. Early ransomware sometimes trapped victims in a full-screen browser window that they could not close without paying. Browsers eventually removed the feature that made those attacks possible. SynkLoader recreates the same trick without a browser. A graphical component draws a replica of the Windows lock screen and keeps the user on the screen until they enter their account password. Researchers described the imitation as almost indistinguishable from the real screen. The malware also does not check whether the password entered is correct, meaning it captures whatever the user types. Single sign-on makes the trick more damaging today. A workstation password may also give an attacker access to several of the applications that employee uses.

 

The big picture

Impersonating the IT service desk is a documented route into health sector organizations, and the HHS Health Sector Cybersecurity Coordination Center has warned about attackers exploiting that relationship. What this case adds is that the usual verification advice fails against it. Staff told to check the sender domain would find a real Microsoft address, and staff told to confirm the download source would find a real Microsoft storage page. Restricting which external tenants can send into the organization, blocking software installation by standard users, and telling staff that IT never initiates contact asking them to install anything all operate without requiring the recipient to spot a forgery. On the detection side, an unexpected Python environment in an application data folder and a scheduled task created outside normal administrative channels are both worth alerting on.

 

FAQs

Why does registering a real Microsoft tenant work better than a fake domain?

Domain reputation checks, email authentication records, and staff training all target domains that imitate a known brand. A tenant registered through Microsoft's own service produces a genuine Microsoft address that passes authentication and carries no reputation history to flag, which removes the signals defenders and users rely on.

 

What does running code in memory accomplish for an attacker?

Antivirus and endpoint tools scan files written to disk, so code that executes directly in memory leaves nothing for those scans to find. Investigators afterward face the same gap, since the evidence disappears when the machine restarts unless memory was captured first.

 

How would a user escape a fake lock screen?

Attempting the standard keyboard interrupt is worth trying, though the reliable approach is a hard power cycle followed by reporting the incident before logging back in. Any password entered into the screen should be treated as compromised and reset from a different device.

 

Why is single sign-on both a security control and a risk?

Consolidating authentication reduces password reuse across services and gives administrators one place to enforce multifactor requirements and revoke access. The same consolidation means one captured credential can open everything that account reaches, which is why organizations pair it with phishing-resistant authentication rather than treating it as sufficient on its own.

 

 

What is an initial access broker's role in a ransomware attack?

They compromise networks and sell that foothold to ransomware operators rather than deploying encryption themselves. Tooling that profiles a network's size and privileges fits that model, since a buyer wants to know how large and valuable an environment is before agreeing on a price.