SynkLoader PhishLocker Behavior
Detects indicators of the PhishLocker credential harvester, specifically the loading of fake Microsoft Visual C++ runtime DLLs from non-standard (user-writable) paths and unauthorized access to Windows lock screen images by Python-based processes.
Cortex XDR
