The fake Windows lock screen is defeated by Alt+Tab — it is just a window pretending

SynkLoader is a previously unknown malware family built across Python, PowerShell, C# and C++, first compiled around 28 July 2026. Marcus Hutchins at Expel analysed it after finding it in live phishing campaigns.

How it arrives

Through Microsoft Teams, from someone claiming to be the company's IT help desk, directing the victim to install a PowerShell Cleaner — an .MSI hosted on Microsoft Azure.

Every part of that is chosen. Teams is internal, so a message there carries authority an email does not. An IT help desk asking you to run a cleanup tool is an ordinary Tuesday. And hosting on Azure means the download URL sits on a Microsoft domain that most organisations allowlist without thinking.

Nothing is exploited. The victim installs it.

The lock screen, and the way to beat it

The PhishLocker module displays a convincing Windows 11 lock screen. The victim, seeing a locked machine, types their password into it.

Expel's finding is the useful part, and it is a one-second check: press Alt+Tab. The fake is just a full-screen borderless GUI application sitting on top of the real windows, so Alt+Tab reveals what is behind it. A genuine lock screen has nothing behind it to reveal.

Ctrl+Alt+Delete works as well, and it is the older version of the same advice — the Secure Attention Sequence exists precisely so that no ordinary application can imitate the screen it produces.

That is a piece of security guidance an ordinary person can actually use, which is rare enough to be worth repeating.

What it takes and what that implies

Beyond the password: hostnames, usernames, privilege levels, Active Directory details and running processes. Further modules provide remote access, persistence, network tunnelling and desktop streaming.

Hutchins reads the Active Directory focus as the tell — measuring the size of the AD environment is what you do when you are pricing a target, which suggests SynkLoader is likely used in ransomware operations.

That fits the shape of the year. Medusa pays initial access brokers between $100 and $1 million, and a loader that reports how large an estate is produces exactly the information that market prices on.

What to do

Teach Alt+Tab. It is the single most useful thing in this story and it takes one sentence.
Verify IT requests out of band. A Teams message is not verification; a known phone number is.
Block unsolicited MSI installs, and do not treat an Azure or Microsoft-hosted URL as evidence of anything. Anyone can rent that address.
Restrict who can message staff in Teams from outside the tenant. External access is the delivery route.
Alert on MSI installs that unpack Python frameworks. That combination is unusual on a corporate endpoint.

What is not established

Who is operating it. No actor named.
Whether ransomware has actually followed. Hutchins describes the likely use, not an observed one.
How many organisations were targeted. No count published.
Which sectors. Not reported.

Interlock used a memory forensics tool to steal the credentials it was built to investigate

2026-08-11Security

A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.

Top Trending Cyber Attacks in 2026: AI, Ransomware & Phishing Evolution

2026-08-08Security

Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.

The fake GTA VI download is 113GB of nothing wrapped around a 50KB payload

2026-08-26Security

Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.

The malware reads its orders out of an FTP welcome message, before it even logs in

2026-08-23Security

MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.

Microsoft spent ten years removing one command, because criminals used it more than administrators did

2026-08-21Security

WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.

Somebody is emailing ransomware victims offering to delete the gang's copy of their data — for $60,000

2026-08-19Security

Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.