Cybersecurity researchers at Cisco Talos have uncovered a sophisticated intrusion campaign active since at least January 2026. Unknown threat actors are deploying a new remote access tool, CloudZ RAT, alongside a previously undocumented plugin, Pheno.
The primary objective of this campaign is to silently harvest victims’ credentials and intercept multi-factor authentication codes, specifically one-time passwords (OTPs).
Instead of trying to infect the victim’s mobile device directly, the attackers use a clever workaround by targeting the bridge between the user’s computer and their smartphone.
The attackers specifically abuse the Microsoft Phone Link application. This built-in Windows synchronization tool mirrors a smartphone’s notifications and messages onto a PC screen via Bluetooth and Wi-Fi.
Because Phone Link synchronizes data such as SMS messages, call logs, and application notifications to a local SQLite database on the computer, the attackers do not need to deploy mobile malware.
Once the PC is compromised, the custom Pheno plugin continually monitors for active Phone Link processes.
If it detects an active connection, the attackers can intercept the local database files to read incoming SMS and authenticator app notifications in real time.
CloudZ Exploits Phone Link
The attack chain begins when a victim is tricked into running a fake ScreenConnect application update, often disguised as “systemupdates.exe.” Thismalicious file acts as an initial dropper, deploying a Rust-compiled loader onto the system.
To establish a permanent foothold, the dropper executes a hidden PowerShell script that creates a scheduled task on the Windows machine.
This task ensures the malware runs whenever the system starts. It achieves this by utilizing a legitimate Windows registration tool, regasm.exe, to silently execute an intermediate .NET loader without raising immediate suspicion.
Once the environment is deemed safe, the loader deploys the modular CloudZ RAT directly into the system’s memory to avoid antivirus detection.
CloudZ connects to its command-and-control (C2) server by retrieving secondary configuration data hosted on attacker-controlled Pastebin accounts using the handler name “HELLOHIALL.” To blend in withnormal network traffic, the malware rotates through standard web browser user-agent strings.
According to talosintelligence research, the most critical module deployed by CloudZ is the Pheno plugin talosintelligence, which is downloaded using a three-step fallback approach that sequentially tries command-line tools such as curl, PowerShell, or bitsadmin to ensure a successful installation.
Once active, Pheno conducts reconnaissance on the victim’s Phone Link application by searching for running processes containing keywords such as “PhoneExperienceHost.”
It specifically looks for local proxy connections that indicate traffic is actively routing between the PC and the phone.
By confirming this active relay channel, Pheno flags the system as “Maybe connected,” enabling the attackers to systematically harvest sensitive OTPs and bypass multi-factor authentication protections entirely from the compromised computer.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
