Phone Link Database Interception

Ethan Andrews@eandrews

•updated May 6, 2026•6•0•237

Detects unexpected access to PhoneExperiences-*.db files which may contain synchronized SMS and OTP messages. This behavior is associated with the CloudZ RAT and Pheno plugin bypassing SMS-based MFA.