Multi-factor authentication (MFA) has long been the gold standard for securing user accounts, forcing attackers to find creative workarounds. Rather than attempting to compromise mobile devices directly to intercept One-Time Passwords (OTPs), threat actors are now leveraging the trust between our PCs and smartphones.
Cisco Talos recently documented an intrusion that combines a remote access trojan (RAT) called CloudZ with a custom plugin named Pheno. The attack bypasses mobile security entirely by hijacking the established PC-to-phone bridge created by the Windows Phone Link application.
The Anatomy of a CloudZ Infection
The infection begins with a deceptive initial access vector, typically a fake ScreenConnect application update. From there, a multi-stage loading process is built to slip past endpoint defenses.
- The Rust Dropper: The initial payload is a 64-bit Rust-compiled executable disguised with legitimate-sounding filenames like
systemupdates.exe. - The .NET Loader: When executed, the dropper decrypts and implants an embedded .NET loader masquerading as a harmless text file (e.g.,
update.txt). - Persistence via LOLBins: An embedded PowerShell script establishes persistence by creating a Scheduled Task (
SystemWindowsApis) that runs under theSYSTEMaccount with the highest privileges. To execute the payload silently, the script uses the legitimate .NET Framework toolregasm.exe(a classic Living-off-the-Land or LOLBin technique). - Reflective Loading: The loader conducts rigorous environment checks. If the checks pass, it decodes a massive hexadecimal blob via bytewise XOR decryption and reflectively loads the CloudZ RAT directly into memory.
Enter CloudZ: A Highly Modular RAT
CloudZ is a modular, heavily obfuscated .NET RAT built to exfiltrate data and keep command-and-control (C2) stable. It rotates between hardcoded User-Agent strings and sends anti-caching headers so its HTTP traffic blends in with legitimate browser activity. CloudZ also relies on dead-drop resolvers, which pull secondary C2 configuration data from Pastebin to locate its final C2 server IP.
Once connected, CloudZ operates via a command dispatcher with capabilities that include:
- Executing arbitrary shell commands.
- Exfiltrating browser credential data.
- Screen recording.
- Deploying additional plugins using a tiered fallback approach (
curl,PowerShell, andbitsadmin).
Pheno Plugin: Stealing OTPs Without Touching the Phone
The most consequential piece of this campaign is the Pheno plugin. Rather than attempt the difficult job of infecting an Android or iOS device, the attacker goes after the Microsoft Phone Link app (formerly "Your Phone").
Phone Link bridges a PC and a smartphone via Wi-Fi and Bluetooth, mirroring SMS messages, call logs, and notifications into a local SQLite database (PhoneExperiences-*.db) on the Windows machine.
The Pheno plugin continually monitors the system for active Phone Link processes such as YourPhone, PhoneExperienceHost, and Link to Windows. It looks for the keyword "proxy" in the output data, a telltale sign that the local proxy relaying traffic between the PC and the paired mobile device is active. Once a connection is confirmed, CloudZ moves in and intercepts the SQLite database.
The attacker gains real-time access to SMS messages and authenticator app notifications, neutralizing OTP-based two-factor authentication without deploying any malware to the victim's mobile phone.
Stringent Evasion Capabilities
CloudZ and its loaders are deeply paranoid, employing several layers of defense evasion:
- Sandbox & VM Evasion: Checks for minimum hardware requirements (e.g., at least two CPU cores) and searches for strings like "VIRTUAL" or "SANDBOX" in directory paths, usernames, and computer names.
- Time-Based Evasion: Calculates the actual elapsed time of a
sleepcommand to detect manipulated analysis environments. - Tool Detection: Enumerates running processes to hunt for security tools like Wireshark, Fiddler, Procmon, and Sysmon. If detected, execution halts.
- Anti-Debugging: Queries the
_ENABLE_PROFILINGenvironment variable to ensure no .NET profilers or debuggers are attached.
MITRE ATT&CK Matrix Mapping
Below is a mapping of the Tactics, Techniques, and Procedures (TTPs) identified in the CloudZ and Pheno campaigns.
| Tactic | Technique ID | Technique Name | Threat Actor Implementation |
|---|---|---|---|
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | Executes scripts to verify running processes and establish persistence. |
| Execution | T1053.005 | Scheduled Task/Job | Creates a Scheduled Task named SystemWindowsApis to execute the malware upon startup. |
| Persistence | T1053.005 | Scheduled Task/Job | Modifies the Task Scheduler to run continuously under the SYSTEM account. |
| Privilege Escalation | T1053.005 | Scheduled Task/Job | Executes the scheduled payload with /rl HIGHEST privileges. |
| Defense Evasion | T1218 | System Binary Proxy Execution | Uses the legitimate regasm.exe (LOLBin) to load and execute the malicious .NET payload. |
| Defense Evasion | T1036 | Masquerading | Disguises executables as system updates (systemupdates.exe) and malicious binaries as text files (update.txt). |
| Defense Evasion | T1027 | Obfuscated Files or Information | Uses ConfuserEx, Base64 encoding, and Hex-XOR decryption for configuration and payload hiding. |
| Defense Evasion | T1620 | Reflective Code Loading | Dynamically loads the decrypted CloudZ .NET payload directly into memory. |
| Defense Evasion | T1497.001 | Virtualization/Sandbox Evasion | Verifies CPU cores (>=2) and checks for VM indicators ("VIRTUAL", "SANDBOX"). |
| Defense Evasion | T1497.003 | Time Based Evasion | Validates environment by measuring the exact elapsed time of a sleep command. |
| Defense Evasion | T1562.001 | Impair Defenses | Scans for active analysis tools (Wireshark, Sysmon, Procmon) to halt execution. |
| Discovery | T1057 | Process Discovery | Uses Get-CimInstance Win32_Process and Pheno to hunt for "YourPhone" and security tools. |
| Discovery | T1082 | System Information Discovery | Collects OS edition, architecture, and hardware specifics. |
| Credential Access | T1555.003 | Credentials from Web Browsers | Uses the BrowserSearch command to exfiltrate browser credentials. |
| Credential Access | T1111 | Two-Factor Authentication Interception | Steals OTPs and SMS verification codes by hijacking Microsoft Phone Link SQLite databases. |
| Collection | T1113 | Screen Capture | Uses the rec command for live screen recording. |
| Collection | T1005 | Data from Local System | Gathers local application data files, primarily PhoneExperiences-*.db. |
| Command and Control | T1102 | Web Service | Uses Pastebin as a dead-drop resolver to fetch secondary C2 configurations. |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols | Communicates with C2 over HTTP utilizing rotated User-Agents and anti-caching headers. |
| Command and Control | T1105 | Ingress Tool Transfer | Downloads the Pheno plugin using a 3-method fallback (curl, PowerShell, bitsadmin). |
Final Thoughts
The CloudZ RAT and Pheno plugin show how threat actors adapt to modern security controls. Endpoint security keeps improving and 2FA is becoming mandatory, so attackers are crossing trust boundaries between devices as well as moving across networks. Synchronization apps like Phone Link deserve the same scrutiny as remote desktop or cloud applications.
Credits: Original research, technical analysis, and telemetry reporting provided by Alex Karkins and Chetan Raghuprasad at Cisco Talos Intelligence. For the full technical breakdown, read their original post: CloudZ RAT potentially steals OTP messages using Pheno plugin.
Gain continuous, structured threat intelligence with the Threat Landscape Platform. Start free — no credit card required — or upgrade to Professional for just $49/month.