CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs

Cisco Talos researchers discovered a CloudZ RAT variant using a new Pheno plugin that monitors Microsoft Phone Link sessions and reads the local SQLite database to steal SMS messages and OTPs, enabling attackers to intercept authentication codes without compromising the mobile device; the report describes the Rust and .NET loaders, persistence via scheduled tasks, anti-analysis checks, additional RAT capabilities (file ops, shell execution, screen recording, plugin management), and published IoCs to help defenders.