New Malware Campaign Uses Windows Phone Link Lure to Deploy CloudZ RAT and Pheno Plugin for Credential Theft

Introduction

Cybersecurity researchers have unveiled a sophisticated intrusion campaign that leverages a malicious version of the Windows Phone Link application to distribute a potent remote access trojan known as CloudZ RAT. The operation also employs a previously undocumented plugin called Pheno, which is specifically designed to steal user credentials and one-time passwords (OTPs). This article provides an in-depth look at the attack chain, the tools involved, and the implications for users worldwide.

What Are CloudZ RAT and the Pheno Plugin?

CloudZ RAT is a remote administration tool that has been repurposed for malicious activities. It allows attackers to gain unauthorized access to a victim's system, execute commands, and exfiltrate sensitive data. The Pheno plugin extends the RAT's capabilities by enabling the collection of saved credentials and the interception of OTPs sent via SMS or authentication apps. According to researchers, the combination of these tools indicates a deliberate focus on bypassing multi-factor authentication (MFA) protections.

Key Capabilities of Pheno

• Credential harvesting: Extracts usernames and passwords from browsers, email clients, and other applications.
• OTP interception: Monitors SMS messages, push notifications, and authenticator app outputs to capture time‑sensitive codes.
• Stealth operations: Operates quietly in the background, evading detection by security software.

Attack Chain: How Windows Phone Link Is Exploited

The attack begins with social engineering. Victims receive or are tricked into downloading a counterfeit version of the Windows Phone Link app, a legitimate utility for connecting mobile devices to Windows PCs. The malicious copy installs the CloudZ RAT alongside the Pheno plugin. Once executed, the RAT establishes a command-and-control (C2) connection, allowing the attackers to deploy additional payloads and begin data theft.

Step‑by‑Step Breakdown

1. Initial vector: Phishing emails, malicious advertisements, or compromised websites offer a fake Windows Phone Link installer.
2. Installation: The dropper unpacks the CloudZ RAT binary and the Pheno plugin DLL.
3. Persistence: The malware adds registry entries or scheduled tasks to ensure it remains active after reboots.
4. Credential harvesting: The Pheno plugin begins scanning local stores and monitoring input fields for login information.
5. OTP capture: It hooks into notification APIs and SMS handlers to intercept one‑time codes.
6. Exfiltration: Stolen data is encrypted and sent to the attackers’ C2 server.

Researchers note that the attackers specifically chose Windows Phone Link because of its widespread use and trust among users who rely on mobile‑PC integration. This trust makes it an effective lure.

Impact and Targets

The primary goal of the campaign is credential theft, with a focus on online banking accounts, corporate VPNs, and email services. By capturing OTPs, the attackers can bypass multi‑factor authentication and gain long‑term access to sensitive systems. Small businesses and individual consumers who use Windows Phone Link are particularly at risk. The malware does not distinguish between operating system versions, affecting both Windows 10 and Windows 11 users.

One security expert emphasized: "According to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of stealing victims' credentials and potentially one‑time passwords (OTPs)." The stolen data can be sold on dark web marketplaces or used for further intrusions.

Mitigation and Recommendations

Users can protect themselves by following these best practices:

• Download software only from official sources — avoid third‑party download sites or unsolicited email attachments.
• Verify app integrity — check digital signatures and file hashes provided by legitimate vendors.
• Use updated antivirus and endpoint detection — solutions that can identify CloudZ RAT and similar trojans.
• Enable advanced MFA — where possible, use hardware tokens or biometrics that are harder to intercept than SMS OTPs.
• Monitor for unusual notifications — unexpected OTP requests or SMS forward requests may indicate compromise.

Organizations should also implement security awareness training to help employees recognize phishing attempts that impersonate popular tools like Windows Phone Link.

Conclusion

The discovery of this CloudZ RAT variant paired with the Pheno plugin highlights the evolving tactics of cybercriminals. By exploiting trusted applications like Windows Phone Link, attackers lower the victim's guard and successfully deploy credential‑stealing malware. As multi‑factor authentication becomes more common, adversaries are developing specialized tools to circumvent it. Staying vigilant, following the mitigation steps above, and keeping security software current are essential defenses against such threats.

For more details on this campaign, readers can refer to the original research by cybersecurity firms monitoring these activities. The attack serves as a reminder that even familiar tools can be weaponized.