CloudZ RAT potentially steals OTP messages using Pheno plugin
Summary: Cisco Talos observed an intrusion in which the CloudZ RAT, a .NET executable compiled Jan. 13, 2026 and obfuscated with ConfuserEx, deployed a plugin called Pheno that scanned for Phone Link processes such as "YourPhone" and "PhoneExperienceHost" and wrote results to staging files. The intrusion began with an unknown initial access vector leading to a fake ScreenConnect update executable, which dropped a .NET loader that established persistence via a scheduled task named SystemWindowsApis running regasm.exe as SYSTEM.
Why it matters: Phone Link stores synchronized SMS messages in a local SQLite database, so an attacker who confirms an active bridge can potentially intercept SMS-based OTP codes and authenticator notifications - the second factor many organizations still rely on for remote access and password resets.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026