Executive Summary
Since January 2026, Cisco Talos has tracked an intrusion campaign using the modular 'CloudZ' RAT and a specialized plugin named 'Pheno' to target mobile-to-PC synchronization. The attack chain begins with a malicious executable disguised as a ScreenConnect update, which deploys a multi-stage loader architecture—first a Rust-based dropper, followed by a .NET loader that reflectively executes the primary RAT in memory.
The technical novelty of this campaign lies in its abuse of the Microsoft Phone Link application. The Pheno plugin specifically targets the SQLite databases and local proxy connections used by Phone Link to mirror mobile notifications, SMS, and call logs to Windows desktops. By monitoring these bridges, the attackers can intercept sensitive two-factor authentication (2FA) codes and other mobile communications without ever compromising the mobile device itself.
This activity represents a significant risk to organizations relying on SMS-based OTP for corporate account access. The use of memory-resident execution, environment-aware evasion checks, and legitimate Windows features (LOLBins) like regasm.exe and bitsadmin underscores a high level of technical proficiency and a focus on long-term stealth.