CloudZ RAT Pheno Microsoft Phone Link credential-theft activity
Malware Activity
Summary
Hide ▲
Show ▼
The CloudZ RAT is now using the Pheno plugin to hijack Microsoft Phone Link sessions and steal SMS-based OTPs and other sensitive codes, increasing the risk of account takeover without directly compromising the phone. The intrusion has been active since at least January and uses a fake ScreenConnect update plus loader stages to install the malware and maintain persistence. CloudZ also adds anti-analysis checks and rotating user-agent strings to help its traffic blend in with normal browser requests.
Related Happenings
TCLBanker self-spreading banking trojan
Malware Activity
H score31
First: 08.05.2026 01:06
Last: 08.05.2026 01:06
Sources 1
About this happening:
The TCLBanker trojan now combines trojanized installer delivery with self-spreading worm modules, widening access to 59 banking, fintech, and cryptocurrency platform...
TCLBanker self-spreading banking trojan
Malware ActivityAbout this happening: The TCLBanker trojan now combines trojanized installer delivery with self-spreading worm modules, widening access to 59 banking, fintech, and cryptocurrency platform...
Storm infostealer server-side decryption activity
Malware Activity
H score18
First: 02.04.2026 17:15
Last: 02.04.2026 17:15
Sources 1
About this happening:
The Storm infostealer now steals browser credentials, session cookies, and crypto wallets and forwards them to attacker infrastructure for server-side decryption...
Storm infostealer server-side decryption activity
Malware ActivityAbout this happening: The Storm infostealer now steals browser credentials, session cookies, and crypto wallets and forwards them to attacker infrastructure for server-side decryption...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware Activity
H score29
First: 01.04.2026 16:30
Last: 01.04.2026 16:30
Sources 1
About this happening:
The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware ActivityAbout this happening: The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Venom Stealer MaaS infostealer with persistent credential harvesting
Malware Activity
H score29
First: 31.03.2026 17:51
Last: 31.03.2026 17:51
Sources 1
About this happening:
The Venom Stealer infostealer now ships as malware-as-a-service (MaaS), expanding access to a persistent credential-theft tool and raising risk for Windows users. It s...
Venom Stealer MaaS infostealer with persistent credential harvesting
Malware ActivityAbout this happening: The Venom Stealer infostealer now ships as malware-as-a-service (MaaS), expanding access to a persistent credential-theft tool and raising risk for Windows users. It s...
Telnyx package WAV-hidden credential-stealing malware
Malware Activity
H score29
First: 27.03.2026 23:13
Last: 27.03.2026 23:13
Sources 1
About this happening:
The malicious Telnyx package releases 4.87.1 and 4.87.2 delivered credential-stealing malware to imported systems, putting Linux, macOS, and Windows environmen...
Telnyx package WAV-hidden credential-stealing malware
Malware ActivityAbout this happening: The malicious Telnyx package releases 4.87.1 and 4.87.2 delivered credential-stealing malware to imported systems, putting Linux, macOS, and Windows environmen...
Timeline
-
05.05.2026 13:03 2 articles · 2mo ago
CloudZ Pheno hijacks Microsoft Phone Link to steal SMS and OTP codes
Technical Analysis UpdateCisco Talos identified a new CloudZ RAT variant using the previously unseen Pheno plugin to monitor active Microsoft Phone Link sessions, access the local SQLite database, and steal SMS-based OTPs, temporary passcodes, and other sensitive codes from mobile-device notifications without directly compromising the phone. The intrusion had been active since at least January and appears aimed at credential theft. The infection chain starts with a fake ScreenConnect update that drops a Rust-based loader, followed by a .NET loader that installs CloudZ RAT, establishes persistence through a scheduled task, and adds anti-analysis checks for tools such as Wireshark, Fiddler, Procmon, and Sysmon. CloudZ also rotates hardcoded user-agent strings and Cisco Talos published IOCs including URLs, hashes, domains, and IP addresses, while recommending phishing-resistant authentication such as hardware keys instead of SMS-based OTP workflows.
Show sources
- CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs — www.bleepingcomputer.com — 05.05.2026 13:03
- CloudZ Malware Abuses Phone Link to Steal SMS OTPs — www.infosecurity-magazine.com — 06.05.2026 18:00