Quick Takeaways
- Threat actors used CloudZ RAT and a new Pheno plugin to hijack Microsoft Phone Link, intercepting SMS and OTP data without malware on mobile devices.
- The attack involved initial access via a fake ConnectWise executable, followed by persistence setup through scheduled tasks and deployment of a modular CloudZ trojan.
- The trojan can execute commands for system info, exfiltrate browser and Phone Link logs, load plugins, and communicate with C2 servers, enabling credential theft and reconnaissance.
Threat Overview, Techniques, and Targets
Cybersecurity researchers have revealed a new type of attack involving a remote access tool called CloudZ RAT and an unknown plugin named Pheno. The attackers used these tools to steal credentials and one-time passwords (OTPs). They operate by abusing the Microsoft Phone Link app on Windows 10 and Windows 11 computers. Phone Link allows users to sync their phone with their PC over Wi-Fi or Bluetooth for calls and messages. The attackers monitored Phone Link activities and intercepted mobile data like SMS and OTPs. This attack does not require installing malware directly on the mobile device. The attack started at least in January 2026 and has not been linked to any known threat group. The attackers first gained access through an undisclosed method. Then they used a fake ConnectWise ScreenConnect file to drop a loader and establish persistence. The loader checks the environment to avoid detection before deploying CloudZ Trojan. CloudZ communicates with its command-and-control server and receives instructions to exfiltrate data or load plugins. The Pheno plugin performs reconnaissance by collecting data from the Phone Link app and sending it back to the hackers.
Impact, Security Risks, and Guidance
This attack poses significant security threats. It allows hackers to steal login credentials and OTPs without hacking into the mobile devices directly. The use of legitimate features like Phone Link makes detection more difficult. As a result, attackers could bypass two-factor authentication processes. The malware can remain hidden on the computer and extract sensitive information quietly. Because the attack chain involves multiple steps and tools, it can have lasting effects on affected systems. Organizations should seek guidance from their security vendors or authorities for proper remediation steps. They should review their environment for signs of compromise and update security defenses. It is important to implement best practices for endpoint protection, monitor unusual activity, and apply patches promptly.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
