> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # CloudZ RAT: A Stealthy New Trojan Hijacks Microsoft Phone Link to Steal Your SMS OTPs - URL: https://darkwebinformer.com/cloudz-rat-a-stealthy-new-trojan-hijacks-microsoft-phone-link-to-steal-your-sms-otps/ - Published: 2026-05-06T18:48:39.000Z - Updated: 2026-05-06T18:49:18.000Z - Author: Dark Web Informer - Tags: News, Malware Malware Threat Intel · 06 May 2026 · 18:22 UTC # CloudZ RAT abuses Microsoft Phone Link to steal SMS OTPs and mobile notifications A newly disclosed remote access trojan turns a built-in Windows feature into a credential-harvesting weapon, and it never has to touch your phone to steal codes meant for it. **Discovered by** Cisco Talos **Active since** January 2026 **Attribution** Unknown Researchers at [Cisco Talos](https://blog.talosintelligence.com/cloudz-pheno-infostealer/) have detailed an ongoing intrusion, active since at least January 2026, in which an unidentified threat actor is deploying a modular .NET-based RAT called **CloudZ**, paired with a previously undocumented plugin known as **Pheno**. Together, the two abuse Microsoft's Phone Link application to siphon off SMS messages, one-time passwords (OTPs), and authenticator app notifications directly from compromised Windows machines. The campaign has been independently covered by [The Hacker News](https://thehackernews.com/2026/05/windows-phone-link-exploited-by-cloudz.html), [BleepingComputer](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/), [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/cloudz-rat-pheno-phone-link-otp/), and [CSO Online](https://www.csoonline.com/article/4167092/stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs.html), among others. ## Why this attack matters Microsoft Phone Link (formerly *Your Phone*) is a legitimate Windows 10/11 sync utility that bridges a PC to an Android or iOS device over Wi-Fi and Bluetooth. Once paired, it mirrors text messages, notifications, and calls onto the desktop and stores synchronized data locally in SQLite databases such as PhoneExperiences-\*.db. That convenience is exactly what the attackers exploit. Rather than breaching the phone itself (a much harder problem), CloudZ targets the PC-side artifacts of an already-trusted bridge. As Talos researchers Alex Karkins and Chetan Raghuprasad put it in their [analysis](https://blog.talosintelligence.com/cloudz-pheno-infostealer/), the goal was stealing victims' credentials and potentially OTPs, without ever deploying malware on the phone. The implication is significant for enterprise defenders: controls focused on mobile device security can be sidestepped entirely if the linked Windows endpoint is compromised. SMS-based and even some app-based MFA flows that rely on push notifications become exposed the moment the desktop is. ## The infection chain According to [Talos](https://blog.talosintelligence.com/cloudz-pheno-infostealer/) and corroborating reporting from [BleepingComputer](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/), the attack unfolds in several stages: 1. **Initial access (unknown vector).** Talos has not yet determined how victims are first compromised, but the foothold leads to execution of a fake ConnectWise ScreenConnect update, typically named systemupdates.exe. 2. **Rust-compiled dropper.** This binary establishes persistence by spawning a hidden PowerShell script that creates a scheduled task (named SystemWindowsApis) to run on system startup. 3. **.NET intermediate loader.** Disguised as a text file in a system directory, the loader executes via the legitimate Windows binary regasm.exe under the SYSTEM account. It also performs heavy anti-analysis checks: timing-based sandbox evasion, enumeration of analysis tools (Wireshark, Fiddler, Procmon, Sysmon), and searches for VM/sandbox indicators in the system path and hostname, as documented by [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/cloudz-rat-pheno-phone-link-otp/). 4. **CloudZ RAT deployment.** Compiled in mid-January 2026 and obfuscated with ConfuserEx, CloudZ decrypts an embedded configuration, opens an encrypted TCP socket to its C2 server, and enters command dispatcher mode. It pulls additional configuration from attacker-controlled Cloudflare Workers domains and from Pastebin pages tagged with the handler HELLOHIALL, while rotating through three hardcoded user-agent strings and anti-caching headers to blend HTTP traffic with normal browser activity. ## What CloudZ can do Beyond Phone Link abuse, CloudZ is a fairly capable modular RAT. According to [Talos](https://blog.talosintelligence.com/cloudz-pheno-infostealer/) and [BleepingComputer](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/), it supports browser data theft, host system profiling, file management (delete, download, write), and arbitrary command execution. It downloads its plugins using a three-method fallback (first attempting curl, then PowerShell's Invoke-WebRequest, and finally falling back to the bitsadmin LOLBin) to maximize the chance a payload lands successfully. ## The Pheno plugin Pheno is the part of the toolkit that turns a generic RAT infection into an OTP-interception capability. Per the [Talos report](https://blog.talosintelligence.com/cloudz-pheno-infostealer/), the plugin scans every running process for keywords associated with Phone Link (YourPhone, PhoneExperienceHost, and Link to Windows) and writes the results to a staging folder. It then performs a secondary check: it reads back its own output files looking for the case-insensitive keyword proxy. Phone Link uses a local proxy connection to relay traffic between the PC and the paired phone, so the presence of "proxy" in a previous run's output indicates an active session. When found, Pheno writes Maybe connected to its output file. CloudZ then reads that staging data and exfiltrates it to the C2 server. With a confirmed Phone Link connection, the operator can then go after the SQLite database file (PhoneExperiences-\*.db) where Phone Link locally caches synchronized SMS and notifications, and that's where authenticator app notifications and SMS-delivered OTPs live, as [CyberInsider](https://cyberinsider.com/cloudz-malware-hijacks-microsoft-phone-link-to-intercept-sms-and-otps/) notes in its writeup. ## Defensive recommendations The advice from Talos and the wider reporting is consistent: - **Move off SMS-based MFA.** It was already the weakest factor, and CloudZ is another reason to retire it. As [BleepingComputer](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/) recommends, prefer phishing-resistant options like FIDO2 hardware keys, or authenticator apps that don't push codes to a paired desktop. - **Audit Phone Link usage.** [CyberInsider](https://cyberinsider.com/cloudz-malware-hijacks-microsoft-phone-link-to-intercept-sms-and-otps/) suggests reviewing whether Phone Link is actually needed in your environment, and disabling it if not. - **Hunt for the IOCs below.** Talos has published [ClamAV signatures, Snort rules, and IOCs](https://github.com/Cisco-Talos/IOCs/tree/main/2026/05) on GitHub. - **Watch for suspicious scheduled tasks** created under SYSTEM that invoke regasm.exe against unusual file paths, and for systemupdates.exe masquerading as ScreenConnect. Talos has not attributed the campaign to any known threat actor. ## Indicators of Compromise Sourced from the [Cisco Talos IOC repository](https://github.com/Cisco-Talos/IOCs/blob/main/2026/05/cloudz-pheno-infostealer.txt). ### File hashes (SHA-256) | Rusty dropper | 65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac | | ------------- | ---------------------------------------------------------------- | | .NET loader | ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832 | | .NET loader | 24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54 | | CloudZ RAT | 5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321 | | Pheno plugin | 33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98 | ### Staging URLs - hxxps://calm-wildflower-1349\[.\]hellohiall\[.\]workers\[.\]dev/ - hxxps://orange-cell-1353\[.\]hellohiall\[.\]workers\[.\]dev/pheno\[.\]exe - hxxps://round-cherry-4418\[.\]hellohiall\[.\]workers\[.\]dev/?t=1769729309 - hxxps://pastebin\[.\]com/raw/8pYAgF0Z?t=1771833517 - hxxps://pastebin\[.\]com/EBrpRiFi - hxxps://pastebin\[.\]com/ikjGHALD - hxxps://pastebin\[.\]com/3jKbe7rN - hxxps://pastebin\[.\]com/NUrZTmDn - hxxps://pastebin\[.\]com/RKJcXMAm - hxxps://pastebin\[.\]com/yUkbaBH3 ### Domains - calm-wildflower-1349\[.\]hellohiall\[.\]workers\[.\]dev - orange-cell-1353\[.\]hellohiall\[.\]workers\[.\]dev - round-cherry-4418\[.\]hellohiall\[.\]workers\[.\]dev ### IP addresses - 185\[.\]196\[.\]10\[.\]136 // C2 server ## References 1. Cisco Talos[CloudZ RAT potentially steals OTP messages using Pheno plugin](https://blog.talosintelligence.com/cloudz-pheno-infostealer/) 2. Cisco Talos[IOC repository (GitHub)](https://github.com/Cisco-Talos/IOCs/blob/main/2026/05/cloudz-pheno-infostealer.txt) 3. The Hacker News[Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs](https://thehackernews.com/2026/05/windows-phone-link-exploited-by-cloudz.html) 4. BleepingComputer[CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/) 5. Infosecurity Mag[CloudZ Malware Abuses Phone Link to Steal SMS OTPs](https://www.infosecurity-magazine.com/news/cloudz-rat-pheno-phone-link-otp/) 6. CSO Online[Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs](https://www.csoonline.com/article/4167092/stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs.html) 7. CyberInsider[CloudZ malware hijacks Microsoft Phone Link to intercept SMS and OTPs](https://cyberinsider.com/cloudz-malware-hijacks-microsoft-phone-link-to-intercept-sms-and-otps/)