Malware exploits Microsoft Phone Link to steal SMS OTPs

A new malware campaign exploits Microsoft's Phone Link feature to intercept SMS-based one-time passwords (OTPs) and can also steal other sensitive mobile data directly from Windows systems.

The activity, first observed by Cisco Talos in January 2026, involves a remote access Trojan called CloudZ and a custom plugin called Pheno , which allow attackers to collect credentials and potentially record authentication codes synced from a user's smartphone .

The attack does not target the mobile device itself. Instead, it exploits the trust between phones and Windows computers, monitoring data mirrored through the Phone Link app.

According to the Cisco Talos report, CloudZ uses the Pheno plugin to hijack the connection between the computer and the phone, exploiting the Microsoft Phone Link application. The plugin constantly scans for active Phone Link processes and potentially intercepts sensitive mobile data such as SMS and OTPs without installing any malware on the phone.

This technique does not require compromising the device itself, which makes the intrusion particularly dangerous.

See also: ScarCruft hacks gaming platform to distribute BirdCall malware

Microsoft Phone Link: How a legitimate feature helps cybercriminals

Microsoft Phone Link, previously known as Your Phone, is a built-in Windows feature that connects a PC to a smartphone and displays messages, notifications, and calls on the desktop. Pheno is designed to detect Phone Link data stored locally on the Windows system.

According to the warning, an attacker using CloudZ “can potentially intercept the SQLite database file of the Phone Link application on the victim’s machine, messages SMS-based OTP.”

Because this data resides on the endpoint, the technique shifts the risk from mobile devices to enterprise-managed Windows systems (potentially bypassing controls focused on smartphone security).

Multi-stage infection chain

At this time, we are unsure of the initial access method. However, it then follows by executing a malicious file disguised as a ScreenConnect update. The initial payload is a loader, written in Rust, using filenames such as “systemupdates.exe”. This loader in turn drops a .NET loader disguised as a text file in a system directory.

Persistence is established through a scheduled task named “SystemWindowsApis”, which runs at startup with elevated privileges, using the legitimate utility regasm.exe. The .NET loader performs anti-parsing checks before unpacking CloudZ. It performs multiple checks to detect security tools and sandbox environments before executing the payload in memory.

The CloudZ payload is then decrypted in memory and executed.

See also: SimpleHelp and ScreenConnect misused for phishing attacks

RAT allows for credential theft and plugin delivery

CloudZ establishes an encrypted connection to a command and control server and supports a range of functions, including credential collection, file operations, and remote command execution.

The malware also retrieves secondary configuration data from attacker-controlled infrastructure. Talos researchers wrote that “the RAT downloads configuration data from remote servers and “extracts the C2 server IP address … and port number … by establishing connections via TCP sockets.

It also rotates user-agent strings to mix its traffic with legitimate browsing activity.

Pheno plugin monitors active device synchronization

The Pheno plugin is responsible for identifying active Phone Link sessions and triggering data interception. “It scans all running processes for specific keywords such as ‘YourPhone’, ‘PhoneExperienceHost’ or ‘Link to Windows’” and logs the results locally,” the researchers say.

The plugin then checks for evidence of a proxy connection used by Phone Link to transfer data between devices.

When such activity is detected, the plugin marks the system as connected, which “ultimately allows the attacker … to potentially monitor SMS or OTP requests that appear in the Phone Link app.”

Talos has released detection signatures and breach indicators to help identify malicious activity.

See also: Abuse of Amazon SES for phishing attacks

This campaign highlights a particularly worrying trend in the cyberthreat landscape: the exploitation of legitimate device synchronization and connectivity as a means of bypassing traditional security mechanisms. The fact that attackers do not need to compromise the smartphone itself, but can gain access to critical data through the connected Windows endpoint, significantly shifts the threat landscape. The interception of OTP codes and other sensitive notifications through a trusted service like Microsoft Phone Link demonstrates that even the most useful features can be turned into entry points for malicious activity.

This development highlights the need for a more holistic approach to enterprise security, where protection is not limited to mobile devices or accounts, but extends to every connected endpoint. Organizations are urged to strengthen monitoring of suspicious activity in sync applications, implement strict endpoint detection controls, and educate users about the risks posed by the interaction between personal devices and corporate systems. In an environment where attacks are becoming increasingly sophisticated, early detection and adaptive defense are critical factors in protection.

Source: www.csoonline.com