CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)

CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to (TL-2026-0459), also tracked as CloudZ RAT, is a high-severity malware campaign, first published 2026-05-05. It has no confirmed attribution, affects Microsoft Phone Link (Link to Windows), maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0459

Threat ID
TL-2026-0459
Also known as
CloudZ RAT, Pheno Plugin, HELLOHIALL campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-05-05
Last reviewed
2026-05-05
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
enterprise, financial-services, technology, professional-services
Target regions
Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

Malware and tooling: CloudZ, Pheno

Cisco Talos disclosed an active intrusion (since at least January 2026) deploying a new CloudZ remote access tool variant with a previously undocumented plugin named Pheno that abuses Microsoft Phone Link sessions on Windows 10/11 to read the local PhoneExperiences SQLite database and steal SMS messages and one-time passwords. The multi-stage chain begins with a fake ScreenConnect update that drops a Rust loader, which executes a .NET loader that installs CloudZ RAT and persists via a SYSTEM-level scheduled task SystemWindowsApis launched through regasm.exe. Attribution is unknown; CloudZ retrieves configuration from Cloudflare workers.dev hosts and Pastebin (handler HELLOHIALL) and beacons over encrypted TCP to 185.196.10.136.

How CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to works

Cisco Talos researchers published a report on 5 May 2026 detailing an intrusion they have tracked since January 2026 in which an unattributed actor deployed a previously-unseen variant of the CloudZ remote access tool together with a brand-new modular plugin called Pheno. The campaign represents a meaningful shift in SMS-based MFA bypass tradecraft because the operator never compromises the victim's mobile device — instead, the Pheno plugin hijacks the Microsoft Phone Link bridge that is already established between a Windows 10/11 host and the user's phone, allowing the attacker to read SMS, OTP and notification data from the locally-cached SQLite database (PhoneExperiences-*.db) that Phone Link populates with synchronised content.

The initial access vector was not recovered by Talos but the first stage observed on disk is a fake ScreenConnect update binary disguised with names such as systemupdates.exe. Execution of this Rust-compiled dropper (SHA256 65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac) drops and executes a heavily obfuscated .NET loader (SHA256 ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832 and 24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54). The .NET loader performs time-based sandbox evasion (measuring elapsed sleep duration to detect API acceleration in analysis environments), enumerates running processes to detect Wireshark, Fiddler, Procmon and Sysmon and exits if any are present, and only then drops and registers the CloudZ RAT (SHA256 5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321).

Persistence is established through a scheduled task named SystemWindowsApis created in the \Microsoft\Windows\ task folder, configured to trigger at system startup, run as the SYSTEM account at highest privilege level, and silently overwrite any pre-existing task of the same name. The task launches the CloudZ payload via the legitimate Microsoft signed binary regasm.exe (Regasm/Regsvcs proxy execution, T1218.009), abusing trust placed in .NET COM assembly registration to bypass application allow-listing.

CloudZ itself is a modular .NET RAT. On execution it retrieves a JSON-style configuration blob from a chain of hosting URLs on Cloudflare workers.dev (calm-wildflower-1349, orange-cell-1353 and round-cherry-4418 under the parent zone hellohiall.workers.dev) or, as a backup dead-drop, from one of seven Pastebin pastes published by the user-handle HELLOHIALL (URLs include https://pastebin.com/raw/8pYAgF0Z, /EBrpRiFi, /ikjGHALD, /3jKbe7rN, /NUrZTmDn, /RKJcXMAm, /yUkbaBH3). The configuration carries a Base64-encoded command identifier table and the IP and port for the attacker-controlled C2 (185.196.10.136). CloudZ then opens an encrypted TCP socket to that endpoint and accepts commands matching its encoded identifiers; documented capabilities include browser data theft (credential and cookie harvesting from Chromium-based browsers), host system profiling, file management (delete, download, write), shell command execution, screen recording, plugin download/installation/management and process termination. HTTP requests rotate between three hardcoded user-agent strings and add anti-caching headers (e.g. Cache-Control: no-cache) so that proxies and CDNs do not cache C2 responses, helping the operator evade defender visibility into infrastructure rotation.

The Pheno plugin is downloaded on demand by CloudZ from https://orange-cell-1353.hellohiall.workers.dev/pheno.exe (SHA256 33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98). Once loaded, Pheno continuously scans the running process list for the keywords YourPhone, PhoneExperienceHost or Link to Windows. When any of those Microsoft Phone Link companion processes is observed, Pheno records the process metadata and inspects open handles for proxy/socket evidence that an active phone-to-PC bridge exists. If the conditions are met, Pheno marks the host as Maybe connected and signals CloudZ to begin collecting the local PhoneExperiences-*.db SQLite file; that database contains synchronised SMS messages, call history and notification payloads — including SMS OTPs and authenticator-app push notifications — which are then exfiltrated through CloudZ's existing C2 channel.

Cisco Talos did not attribute the activity to a known threat actor. Victimology is described only as enterprise environments and the operator's apparent goal is credential and OTP theft, consistent with financially-motivated access brokerage or follow-on account takeover, although espionage cannot be ruled out. Defenders should treat the Pheno technique as a generic SMS-MFA bypass primitive: any malware with code execution on a Windows 10/11 host where Phone Link is paired can read OTPs without ever touching the phone or the cellular carrier, breaking the trust assumption behind SMS-delivered second factors for users who use Phone Link in enterprise BYOD scenarios.

MITRE ATT&CK techniques used in TL-2026-0459

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.009 System Binary Proxy Execution: Regsvcs/Regasm; T1497 Virtualization/Sandbox Evasion; T1497.003 Time Based Checks; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547 Boot or Logon Autostart Execution

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1095 Non-Application Layer Protocol; T1102 Web Service; T1102.001 Web Service: Dead Drop Resolver; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

execution

T1204 User Execution

Affected products and versions in CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

  • Microsoft — Phone Link (Link to Windows)
    Vulnerable versions: all currently shipping versions on Windows 10 and Windows 11
  • Microsoft — Windows 10
    Vulnerable versions: any build with Phone Link paired
  • Microsoft — Windows 11
    Vulnerable versions: any build with Phone Link paired
  • ConnectWise — ScreenConnect (impersonated, not vulnerable)

Remediation for CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

Patches

  • No vendor patch available — this is malware, not a software vulnerability. Microsoft Phone Link itself is not vulnerable; the malware abuses local code execution to read its data files.

Immediate actions

  • Block the C2 IP 185.196.10.136 at egress firewalls and EDR network containment
  • Block DNS resolution and HTTP egress for *.hellohiall.workers.dev and the three observed worker subdomains (calm-wildflower-1349, orange-cell-1353, round-cherry-4418)
  • Block egress to the seven listed pastebin.com configuration URLs and consider broader policy on raw Pastebin from endpoints that do not require it
  • Hunt for the five SHA256 hashes (Rust dropper, two .NET loaders, CloudZ RAT, Pheno plugin) across EDR file telemetry and threat intel platforms
  • Search Task Scheduler for a task named SystemWindowsApis under \Microsoft\Windows\ and any task that launches regasm.exe with a non-Microsoft assembly path
  • Audit any host where Microsoft Phone Link is installed and paired for unexpected reads of PhoneExperiences-*.db or unusual access to %LOCALAPPDATA%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\

Workarounds

  • Uninstall or unpair Microsoft Phone Link on hosts holding privileged OTP-protected accounts
  • Disable SMS notification synchronisation in Phone Link settings to limit the SMS payloads written to PhoneExperiences-*.db
  • Where Phone Link must remain in use, monitor PhoneExperiences-*.db for reads by processes other than the Phone Link package itself

Longer-term hardening

  • Move users off SMS-delivered OTPs to phishing-resistant MFA (FIDO2/WebAuthn, hardware tokens, or platform passkeys) for any account where SMS is still the second factor
  • Restrict or remove Microsoft Phone Link on managed enterprise endpoints where it is not a documented business requirement, especially privileged workstations
  • Application allow-listing policies (WDAC/AppLocker) that constrain regasm.exe to signed-vendor assembly paths, breaking the T1218.009 proxy-execution chain
  • Deploy EDR rules for child processes of regasm.exe spawning network connections, and for scheduled tasks created at SYSTEM privilege from non-installer parents
  • Egress policy that requires authenticated proxy traversal for *.workers.dev and pastebin.com from endpoints — Cloudflare Workers and Pastebin are heavily abused as dead-drops

Timeline of CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

  • CloudZ RAT (SHA256 5b7284bc...b321) retrieves configuration from Cloudflare workers.dev hosts under hellohiall.workers.dev and Pastebin handler HELLOHIALL, then connects to 185.196.10.136 over encrypted TCP.
  • Scheduled task SystemWindowsApis is created under \Microsoft\Windows\ to launch CloudZ via regasm.exe at boot under SYSTEM at highest privilege.
  • .NET loader (SHA256 ed5de036...3832 / 24398b75...eb54) is dropped, runs sandbox/anti-analysis checks (Wireshark, Fiddler, Procmon, Sysmon plus elapsed-sleep timing) and prepares CloudZ deployment.
  • Victim executes a fake ScreenConnect update binary (Rust dropper, SHA256 65fcd965...77dac), believed delivered via unrecovered initial access vector.
  • Cisco Talos telemetry first records the CloudZ + Pheno intrusion in a victim environment; activity has continued since at least this date.
  • CloudZ downloads Pheno plugin (SHA256 33af5545...fd98) from https://orange-cell-1353.hellohiall.workers.dev/pheno.exe and begins scanning for YourPhone, PhoneExperienceHost and Link to Windows processes to locate the PhoneExperiences SQLite database.
  • Cisco Talos publishes the cloudz-pheno-infostealer IOC bundle (text + STIX JSON) to the public Cisco-Talos/IOCs GitHub repository.
  • Threadlinqs Intelligence ingests TL-2026-0459 with full IOC, MITRE and detection coverage; defenders advised to hunt and block immediately.
  • Cisco Talos publishes the public technical analysis blog post; coverage by BleepingComputer, CSO Online, Computerworld and CyberInsider follows the same day.
  • As of 2026-05-29, the CloudZ RAT/Pheno campaign remains active: Talos disclosed it 2026-05-05 (live since Jan 2026) with no takedown, arrest, or attribution since, and C2 (185.196.10.136, *.hellohiall.workers.dev) still flagged. No patch exists since Pheno abuses a legitimate Phone Link feature, keeping the SMS-OTP bypass viable.

Sources cited for CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

Threats related to CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to

Detection coverage for TL-2026-0459

As of 2026-05-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0459 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats