# CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)

> Cisco Talos disclosed an active intrusion (since at least January 2026) deploying a new CloudZ remote access tool variant with a previously undocumented plugin named Pheno that abuses Microsoft Phone Link sessions on Windows 10/11 to read the local PhoneExperiences SQLite database and steal SMS messages and one-time passwords. The multi-stage chain begins with a fake ScreenConnect update that drops a Rust loader, which executes a .NET loader that installs CloudZ RAT and persists via a SYSTEM-level scheduled task SystemWindowsApis launched through regasm.exe. Attribution is unknown; CloudZ retrieves configuration from Cloudflare workers.dev hosts and Pastebin (handler HELLOHIALL) and beacons over encrypted TCP to 185.196.10.136.

- **Published:** 2026-05-05T12:00:00Z
- **Last reviewed:** 2026-05-05T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0459
- **ID:** TL-2026-0459
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos researchers published a report on 5 May 2026 detailing an intrusion they have tracked since January 2026 in which an unattributed actor deployed a previously-unseen variant of the CloudZ remote access tool together with a brand-new modular plugin called Pheno. The campaign represents a meaningful shift in SMS-based MFA bypass tradecraft because the operator never compromises the victim's mobile device — instead, the Pheno plugin hijacks the Microsoft Phone Link bridge that is already established between a Windows 10/11 host and the user's phone, allowing the attacker to read SMS, OTP and notification data from the locally-cached SQLite database (PhoneExperiences-*.db) that Phone Link populates with synchronised content.

The initial access vector was not recovered by Talos but the first stage observed on disk is a fake ScreenConnect update binary disguised with names such as systemupdates.exe. Execution of this Rust-compiled dropper (SHA256 65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac) drops and executes a heavily obfuscated .NET loader (SHA256 ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832 and 24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54). The .NET loader performs time-based sandbox evasion (measuring elapsed sleep duration to detect API acceleration in analysis environments), enumerates running processes to detect Wireshark, Fiddler, Procmon and Sysmon and exits if any are present, and only then drops and registers the CloudZ RAT (SHA256 5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321).

Persistence is established through a scheduled task named SystemWindowsApis created in the \Microsoft\Windows\ task folder, configured to trigger at system startup, run as the SYSTEM account at highest privilege level, and silently overwrite any pre-existing task of the same name. The task launches the CloudZ payload via the legitimate Microsoft signed binary regasm.exe (Regasm/Regsvcs proxy execution, T1218.009), abusing trust placed in .NET COM assembly registration to bypass application allow-listing.

CloudZ itself is a modular .NET RAT. On execution it retrieves a JSON-style configuration blob from a chain of hosting URLs on Cloudflare workers.dev (calm-wildflower-1349, orange-cell-1353 and round-cherry-4418 under the parent zone hellohiall.workers.dev) or, as a backup dead-drop, from one of seven Pastebin pastes published by the user-handle HELLOHIALL (URLs include https://pastebin.com/raw/8pYAgF0Z, /EBrpRiFi, /ikjGHALD, /3jKbe7rN, /NUrZTmDn, /RKJcXMAm, /yUkbaBH3). The configuration carries a Base64-encoded command identifier table and the IP and port for the attacker-controlled C2 (185.196.10.136). CloudZ then opens an encrypted TCP socket to that endpoint and accepts commands matching its encoded identifiers; documented capabilities include browser data theft (credential and cookie harvesting from Chromium-based browsers), host system profiling, file management (delete, download, write), shell command execution, screen recording, plugin download/installation/management and process termination. HTTP requests rotate between three hardcoded user-agent strings and add anti-caching headers (e.g. Cache-Control: no-cache) so that proxies and CDNs do not cache C2 responses, helping the operator evade defender visibility into infrastructure rotation.

The Pheno plugin is downloaded on demand by CloudZ from https://orange-cell-1353.hellohiall.workers.dev/pheno.exe (SHA256 33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98). Once loaded, Pheno continuously scans the running process list for the keywords YourPhone, PhoneExperienceHost or Link to Windows. When any of those Microsoft Phone Link companion processes is observed, Pheno records the process metadata and inspects open handles for proxy/socket evidence that an active phone-to-PC bridge exists. If the conditions are met, Pheno marks the host as Maybe connected and signals CloudZ to begin collecting the local PhoneExperiences-*.db SQLite file; that database contains synchronised SMS messages, call history and notification payloads — including SMS OTPs and authenticator-app push notifications — which are then exfiltrated through CloudZ's existing C2 channel.

Cisco Talos did not attribute the activity to a known threat actor. Victimology is described only as enterprise environments and the operator's apparent goal is credential and OTP theft, consistent with financially-motivated access brokerage or follow-on account takeover, although espionage cannot be ruled out. Defenders should treat the Pheno technique as a generic SMS-MFA bypass primitive: any malware with code execution on a Windows 10/11 host where Phone Link is paired can read OTPs without ever touching the phone or the cellular carrier, breaking the trust assumption behind SMS-delivered second factors for users who use Phone Link in enterprise BYOD scenarios.

## MITRE ATT&CK

- T1204 User Execution
- T1204.002 User Execution: Malicious File
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547 Boot or Logon Autostart Execution
- T1218.009 System Binary Proxy Execution: Regsvcs/Regasm
- T1497.003 Time Based Checks
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1057 Process Discovery
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1102 Web Service
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [CloudZ RAT potentially steals OTP messages using Pheno plugin](https://blog.talosintelligence.com/cloudz-pheno-infostealer/)
- [Cisco Talos IOC repository - cloudz-pheno-infostealer.txt](https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2026/05/cloudz-pheno-infostealer.txt)
- [Cisco Talos IOC repository - cloudz-pheno-infostealer.json (STIX)](https://raw.githubusercontent.com/Cisco-Talos/IOCs/main/2026/05/cloudz-pheno-infostealer.json)
- [CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/)
- [Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs](https://www.csoonline.com/article/4167092/stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs.html)
- [Microsoft Phone Link abused to steal SMS OTPs from enterprise PCs](https://www.computerworld.com/article/4167111/stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs-2.html)
- [CloudZ malware hijacks Microsoft Phone Link to intercept SMS and OTPs](https://cyberinsider.com/cloudz-malware-hijacks-microsoft-phone-link-to-intercept-sms-and-otps/)
- [MITRE ATT&CK T1218.009 - Regsvcs/Regasm](https://attack.mitre.org/techniques/T1218/009/)
- [MITRE ATT&CK T1053.005 - Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0459