Top Highlights
- Attackers implant CloudZ RAT and a custom plugin "Pheno" to steal credentials, OTPs, and intercept SMS data via abuse of Windows Phone Link app.
- The intrusion uses a Rust-based dropper and a .NET loader to establish persistence, evade detection, and dynamically execute malicious modules in memory.
- CloudZ communicates with its C2 servers through layered download methods, rotatable user-agents, and exfiltrates browser and mobile data, enabling remote control and credential theft.
Threat, Attack Techniques, and Targets
Cisco Talos discovered an active intrusion since at least January 2026. The attacker implanted a Remote Access Tool called CloudZ RAT and a new plugin named Pheno. The goal was to steal credentials and one-time passwords (OTPs). CloudZ RAT uses the Pheno plugin to monitor the Windows Phone Link application, which links a PC and mobile phone. The RAT hijacks the Phone Link PC-to-phone bridge by abusing the application. This allows the attacker to scan for active Phone Link processes and potentially intercept SMS messages and OTPs. The attacker evades detection by running malicious functions in memory and avoiding sandbox or debugger environments. The targets are Windows systems with Phone Link enabled.
The attack begins with an unknown access method. It then drops a fake Windows application update executable. This loader decrypts its configuration, connects secretly to a command-and-control server, and downloads a plugin (Pheno). The plugin helps reconnaissance of Phone Link activity. The attacker also downloads CloudZ RAT itself as a modular, obfuscated .NET binary. CloudZ queries running processes for certain keywords to detect analysis tools. It checks system hardware and environment details to identify virtual machines or sandboxes. It employs fallback methods like curl, PowerShell, or bitsadmin to download its payloads. The payloads include the CloudZ RAT binary, which manages commands from C2 servers for data exfiltration and control.
Impact, Security Implications, and Remediation Guidance
This threat can have serious consequences. The attacker may steal OTP messages, SMS communications, browser credentials, and other sensitive data. Since the RAT can intercept OTPs, it could aid in bypassing two-factor authentication. The malware’s ability to evade detection and operate in memory makes it hard to identify using conventional tools. The attacker can also execute commands to download, delete, or manage files, or report errors back to C2. This gives them full control over the compromised system.
The presence of CloudZ RAT and Pheno plugin indicates a high risk of data theft. Organizations should prioritize detection and removal of such malware. Security measures must include updated signatures for antivirus and intrusion detection systems. Monitoring process activity, network connections, and file modifications linked to this threat is crucial. Since specific remediation steps depend on the environment, organizations should retrieve detailed guidance from their security vendor or relevant authorities.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
