Back Newsbytesapp

CloudZ malware targets Microsoft Phone Link to steal phone data

Newsbytesapp • May 5, 2026

Heads up if you use Windows 10 or 11: a new malware called CloudZ is targeting the built-in Microsoft Phone Link app to swipe info from your phone. Discovered by Cisco Talos , CloudZ has been around since January and uses a sneaky plugin called "Pheno" to grab things like passwords, texts, and even one-time passcodes sent between your phone and PC.

CloudZ has been seen arriving via a fake ScreenConnect application update, though its initial entry point remains unclear. To keep your data safe, stick to official downloads, run regular antivirus scans, and avoid plugging in random USBs or connecting untrusted devices. A little caution goes a long way.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CloudZ RAT Exploits Microsoft Phone Link to Steal SMS OTPs A new malware campaign involving the CloudZ remote access trojan (RAT) and its Pheno plugin is targeting Microsoft’s Phone Link feature to intercept SMS-based one-time passwords (OTPs) and other sensitive data from Windows PCs. Discovered by Cisco Talos, the malware exploits the trust relationship between Windows systems and mobile devices without needing to compromise the mobile device itself. The attack begins with an unknown initial access vector, leading to the execution of a fake ScreenConnect application update that drops a Rust-compiled loader. This loader installs a .NET loader that deploys the CloudZ RAT, which can access the SQLite database of the Phone Link application to siphon sensitive information. The campaign has been active since at least January 2026, posing a significant risk to enterprises relying on SMS-based multi-factor authentication. Talos has provided indicators of compromise (IOCs) to help organizations defend against this threat. 7 sources 73

Extracted Entities

CloudZ malware targets Microsoft Phone Link to steal phone data

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (2)