Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs

Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs Ravie LakshmananMay 06, 2026Endpoint Security / Threat Intelligence Cybersecurity researchers have disclosed details of an intrusion that involved the use of a CloudZ remote access tool (RAT) and a previous undocumented plugin dubbed Pheno with the aim of facilitating credential theft. "According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of stealing victims' credentials and potentially one-time passwords (OTPs)," Cisco Talos researchers Alex Karkins and Chetan Raghuprasad said in a Tuesday analysis. What makes the attack novel is that CloudZ uses the custom Pheno plugin to hijack the established PC-to-phone bridge by abusing the Microsoft Phone Link application, permitting the plugin to monitor for active Phone Link processes and potentially intercept sensitive mobile data like SMS and one-time passwords (OTPs) without the need for deploying malware on the phone.  The findings demonstrate how legitimate cross-device syncing features can expose unintended attack pathways to credential theft and help bypass two-factor authentication. What's more, it obviates the need to compromise the mobile device itself. The malware, per the cybersecurity company, has been put to use as part of an intrusion that's been active since at least January 2026. The activity has not been attributed to any known threat actor or group. Built into Windows 10 and Windows 11, Phone Link offers a way for users to pair their computer with an Android device or iPhone over Wi-Fi and Bluetooth, allowing users to make or take phone calls, send messages, and dismiss notifications. Unknown threat actors have been observed attempting to leverage the application using CloudZ RAT and Pheno to confirm Phone Link activity on a victim environment and then access the SQLite database file used by the program to store the synchronized phone data.  The attack chain is said to have employed an as-yet-undetermined initial access method to obtain a foothold and drop a fake ConnectWise ScreenConnect executable that's responsible for downloading and running a .NET loader.  The initial dropper also makes use of an embedded PowerShell script to establish persistence by setting up a scheduled task that runs the malicious .NET loader. The intermediate loader is designed to run hardware and environment checks to evade detection and deploy the modular CloudZ trojan on the machine. Once executed, the .NET-compiled trojan decrypts an embedded configuration, establishes an encrypted socket connection to the command-and-control (C2) server, and awaits Base64-encoded instructions that allow it to exfiltrate credentials and implant additional plugins. Some of the commands supported by CloudZ include - pong, to send heartbeat responses PING!, to issue a heartbeat request CLOSE, to terminate the trojan process INFO, to collect system metadata RunShell, to execute shell command BrowserSearch, to exfiltrate web browser data GetWidgetLog, to exfiltrate Phone Link recon logs and data plugin, to load a plugin savePlugin, to save a plugin to disk at the staging directory ("C:\ProgramData\Microsoft\whealth\") sendPlugin, to upload a plugin to C2 server RemovePlugins, to remove all deployed plugin modules Recovery, to enable recovery or reconnection DW, to conduct download and file write operations FM, to conduct file management operations Msg, to send a message to C2 server Error, to report errors to C2 server rec, to record the screen "The attacker used a plugin called Pheno to perform reconnaissance of the Windows Phone Link application in the victim machine," Talos said. "The plugin performs reconnaissance of the Microsoft Phone Link application on the victim machine and writes the reconnaissance data to an output file in a staging folder. CloudZ reads back the Phone Link application data from the staging folder and sends it to the C2 server." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Cloud security, Credential Theft, cybersecurity, endpoint security, Malware, Remote Access Trojan, Threat Intelligence, windows security ⚡ Top Stories This Week Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches Vercel Finds More Compromised Accounts in Context.ai-Linked Breach ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking and More Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack Load More ▼ ⭐ Featured Resources [Guide] Learn a Practical Framework to Evaluate AI Tools for Production Learn How Hidden Identity Blind Spots Weaken Your Security Systems [Guide] How to Enable Secure Data Movement Without Added Risk [Webinar] Stop Chasing Alerts and Start Focusing on Real Exposures