CloudZ Malware Abuses Phone Link to Steal SMS OTPs

Cisco Talos researchers reported a Windows malware campaign active since at least January 2026 using a .NET RAT called CloudZ and a previously undocumented plugin named Pheno to hijack Microsoft Phone Link and exfiltrate SMS messages and OTPs from local Phone Link SQLite databases; the attack chain includes a Rust loader, regasm-based persistence, obfuscation/anti-analysis, staged C2/Pastebin configuration, and published IOCs and signatures to aid detection.