CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

CloudZ RAT abuses Microsoft Phone Link via Pheno plugin for credential and OTP theft

First reported
Last updated
2 unique sources, 2 articles

Summary

Hide ▲

Since at least January 2026, threat actors have abused the CloudZ RAT and custom Pheno plugin to hijack Microsoft Phone Link on Windows hosts, enabling credential and OTP theft by intercepting synchronized mobile data without mobile device compromise. The attack chain begins with a fake ScreenConnect executable delivering a Rust-compiled loader that deploys CloudZ via regasm.exe, establishing persistence via a scheduled task under the SYSTEM account. CloudZ includes 20+ commands for data theft and system control, while the Pheno plugin scans for active Phone Link sessions to harvest synchronized content from SQLite databases like PhoneExperiences-*.db. Cisco Talos has published IOCs and ClamAV signatures to aid detection. The intrusion leverages Phone Link’s desktop synchronization of SMS, call logs, and notifications over Wi-Fi/Bluetooth, exposing a critical gap in MFA defenses that focus solely on mobile endpoints. The malware employs anti-analysis techniques and retrieves secondary configuration from staging servers and Pastebin, rotating user-agent strings to blend with legitimate traffic. No attribution to a known threat actor has been made.

Timeline

  1. 06.05.2026 11:34 2 articles · 1d ago

    CloudZ RAT with Pheno plugin abuses Microsoft Phone Link for credential and OTP theft since January 2026

    Additional technical details emerge about CloudZ’s operational mechanics and Pheno’s behavior. Pheno scans Windows processes for Phone Link-related keywords (e.g., YourPhone, PhoneExperienceHost, Link to Windows) and confirms live Phone Link sessions by detecting the local proxy relay, tagging systems for follow-on data collection. CloudZ, compiled in mid-January 2026 and obfuscated with ConfuserEx, employs anti-analysis layers including timing-based sleep checks, enumeration of security tools (Wireshark, Procmon, Sysmon), and VM indicators in system path/hostname. The RAT retrieves secondary configuration from attacker-controlled staging servers and Pastebin, rotates through three hardcoded user-agent strings to blend HTTP traffic, and supports commands for credential exfiltration, plugin management, and screen recording. Cisco Talos has published IOCs and ClamAV signatures to assist defenders in detecting and blocking the activity.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

CloudZ RAT leverages Microsoft Phone Link to intercept SMS and OTPs via Pheno plugin

A newly identified CloudZ remote access trojan (RAT) variant deploys a malicious plugin named Pheno that exploits Microsoft Phone Link on Windows 10/11 systems to intercept SMS messages and one-time passwords (OTPs) from paired Android or iOS devices without requiring direct compromise of the mobile endpoint. The intrusion has been active since at least January 2026 and is designed to harvest credentials and temporary authentication codes delivered via SMS or authenticator app notifications. The attack abuses Microsoft Phone Link’s local SQLite database and session monitoring to exfiltrate sensitive data via the compromised Windows host.

Open in new tab