Cybersecurity threats evolve with SynkLoader malware and BlueKit phishing kits

Security researchers have identified two distinct trends in sophisticated cyberattacks: the use of trusted collaboration tools for social engineering and the rise of automated phishing-as-a-service kits.

Researchers at Expel uncovered SynkLoader, a polymorphic malware family that exploits Microsoft Teams to target corporate networks. The attack begins when threat actors impersonate internal IT help desks via Microsoft Teams external chat. Using a Microsoft 365 default email domain to establish legitimacy, attackers persuade employees to download malicious executables. SynkLoader utilizes a complex architecture involving Python, PowerShell, C#, and C++ to perform tasks such as credential theft via fake Windows lock screens, lateral movement, and maintaining persistence through Windows Registry modifications.

Separately, Malwarebytes has tracked the evolution of BlueKit, a phishing-as-a-service (PhaaS) toolkit. This turnkey kit allows low-skill criminals to launch sophisticated account-hijacking campaigns through a centralized dashboard. BlueKit provides an extensive library of templates for 97 different brands across 176 variants, enabling attackers to deploy “pixel-perfect” phishing pages with minimal technical effort.