Pheno Plugin Recon Through Windows Phone Link App

Lightkun Yagami@lightkun_CrowdStriker

•updated May 6, 2026•7•0•170

Cisco Talos observed that attackers used a plugin called Pheno to conduct reconnaissance on the Windows Phone Link App on the victim's PC. IF compromised, Pheno logs the Process IDs and file paths with the filename "phonelink-<COMPUTERNAME>.txt", created in two staging folders: C:\programdata\Microsoft\feedback\cm %TEMP%\Microsoft\feedback\cm