CloudZ RAT Exploits Microsoft Phone Link to Steal SMS OTPs

CloudZ is a modular .NET remote access trojan observed since at least January 2026 that, together with a Pheno plugin, abuses Microsoft Phone Link to capture SMS OTPs and mobile notifications mirrored to Windows PCs. Cisco Talos describes an infection chain beginning with a fake ScreenConnect update that deploys a Rust loader and a .NET loader, establishes persistence via a scheduled task and regasm LOLBin, uses extensive anti‑analysis and in‑memory techniques, connects to encrypted C2, and exfiltrates Phone Link databases and reconnaissance logs, allowing attackers to intercept authentication flows without infecting the mobile device.