Threat Analysis: SynkLoader Teams Phishing and Rust Supply Chain Attacks, What UK SMBs Need to Know
Hello, Mauven here.
This is your Daily Threat Analysis for 21st August 2026.
Two stories today. Neither is theoretical. Both are active campaigns with direct exposure paths for UK small businesses. I have picked these two specifically because they exploit the mundane, a Teams message from what looks like your IT desk, and a software dependency that looked entirely legitimate until it wasn’t.
SynkLoader: When Your IT Helpdesk Comes to You
Expel’s research team published analysis this week on a loader they are calling SynkLoader. The attack chain starts on Microsoft Teams.
The attacker impersonates an IT helpdesk employee. The message is plausible, something along the lines of a system scan being required, or a clean-up tool needing to run before a scheduled update. The target is directed to install what appears to be a PowerShell maintenance script delivered via an MSI installer. It looks like the sort of thing your managed service provider might legitimately ask you to run.
It is not.
Once installed, SynkLoader deploys a modular, memory-resident payload that bridges Python, C#, C++, and PowerShell. That multi-language architecture is not accidental, it is designed specifically to confuse endpoint detection that looks for single-language malware signatures. The loader profiles the system, establishes a reverse proxy for command-and-control access, and installs a fake lock screen to harvest credentials when the user next authenticates.
Nothing is written to disk in a form that standard antivirus is likely to catch. By the time the user notices anything unusual, their credentials have already left the building.
What the report does not emphasise enough: Microsoft Teams external access controls are, in many SMB environments, left at their defaults. The default configuration in Microsoft 365 Business Basic and Standard allows messages from external Teams tenants unless an administrator has explicitly restricted this. If your IT provider has not reviewed those settings, a stranger can message your staff directly and pose as your internal helpdesk. This is not a sophisticated technical attack. It is social engineering dressed in a Teams notification.
The NCSC has published guidance on phishing-resistant authentication and on reviewing Microsoft 365 configurations. The fact that attackers are still finding willing victims via Teams helpdesk impersonation tells you how many businesses have read it.
What to do
- Tell every member of staff, today, that your IT team will never send an unsolicited Teams message asking them to run a script or install a tool. If they get one, they should call IT on a number they already know, not reply in Teams.
- Ask your IT provider or MSP whether external Teams federation is restricted to known partner tenants, or whether it is open by default.
- Review whether your Microsoft 365 tenant has Conditional Access policies in place. If you do not know what that means, ask your provider. If they cannot explain it, that is worth knowing.
Rust Supply Chain: The Dependency You Did Not Know You Had
Socket’s research published this week documents a coordinated supply chain attack against three widely used Rust crates: arrayref, internment, and append-only-vec. These are legitimate packages maintained by a real developer, David Roundy, with genuine download histories. The attacker did not compromise the packages directly. Instead, they published a malicious crate called proc-macro1, a deliberate typosquat of the legitimate and extremely common proc-macro2.
The malicious dependency was then injected into the three compromised crates. Any developer or build pipeline that pulled these packages via Cargo, Rust’s package manager, automatically executed the malicious build.rs script. The malware ran at build time, before the application ever shipped to an end user.
This matters to UK SMBs in two ways that tend to get lost in the developer-focused coverage.
First, if your business uses bespoke software built by a development agency or in-house developers who use Rust, your build pipeline may have pulled this dependency during a routine build. You would not necessarily know. The malware executed silently.
Second, if any of your software vendors use Rust in their build chain, and Rust adoption has grown significantly in security tooling, networking software, and cloud-native applications, their compiled products may have been built in a compromised environment. That is a harder question to answer, and most SMBs will not be able to answer it without asking their vendors directly.
What the advisory does not say: The broader pattern here is not new. Typosquatting attacks against package registries, npm, PyPI, and now crates.io, have been documented for years. The NCSC has published software supply chain guidance. The question is not whether this class of attack was foreseeable. It was entirely foreseeable. The question is whether your software procurement process includes any verification of the supply chain behind the tools you buy and deploy.
For most SMBs, the honest answer is no.
What to do
- If you have in-house developers or commission bespoke software, ask them to check Cargo.lock files in any Rust projects for references to proc-macro1. The legitimate package is proc-macro2. The typosquat, proc-macro1, should not be present.
- If you use third-party software built with Rust, raise a query with your vendor asking whether their build environment was audited following the crates.io compromise reported this week. A reputable vendor will have a clear answer.
- More broadly, ask your IT provider what software supply chain verification they perform before deploying updates to your systems. If the answer is nothing beyond checking the publisher’s digital signature, that conversation is worth having.
The Wider Picture
These two stories are not unconnected in character, even if they are unconnected operationally. Both exploit trust, in this case, trust in a familiar communication channel, and trust in a dependency that had a legitimate history.
That is the consistent thread running through the most effective attacks against SMBs. They do not break through the door. They walk in through the one you left open because you thought you knew who was knocking.
Microsoft Teams is not a secure internal channel by default. Your software dependencies are not verified by default. Neither of those things will change unless someone in your organisation specifically decides to change them.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up.
Sources
| # | Source | Title | URL |
|---|---|---|---|
| 1 | Expel | SynkLoader: when you throw in everything but the kitchen sink | https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/ |
| 2 | Socket | Popular Rust Crates Compromised in Build-Time Supply Chain Attack | https://socket.dev/blog/popular-rust-crates-compromised |
| 3 | CloudSEK | BRIDGEHEAD: An npm typosquatting campaign that crosses from WSL into Windows | https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer |
| 4 | Google Threat Intelligence | Distinct Clusters Target Individuals of Interest to Russia | https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia |
| 5 | Menlo Security | The Evolution of ClickFix: From Cleartext to Server Side Polymorphism | https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism |