New “Pheno” Malware Hijacks Microsoft Phone Link to Steal SMS and OTPs

Cisco Talos reports an active campaign (since at least Jan 2026) in which the CloudZ RAT and a specialized Pheno plugin abuse Microsoft Phone Link on compromised Windows hosts to intercept synchronized SMS, call logs, and OTPs from system memory, enabling OTP/2FA bypass without installing malware on the phone; the tools use memory-only execution and anti-forensic checks to evade detection.