CloudZ RAT potentially steals OTP messages using Pheno plugin

Reported 05 May 2026 by otx · Severity: medium

Cisco Talos uncovered an intrusion active since January 2026 where attackers deployed CloudZ remote access tool and an undocumented plugin called Pheno to steal credentials and one-time passwords. The attack exploits Microsoft Phone Link application by intercepting synchronized m