CloudZ RAT exploits Microsoft Phone Link to steal SMS and OTPs
Disable Microsoft Phone Link on all Windows machines, enforce hardware‑based MFA, and block CloudZ RAT traffic.
Disable Microsoft Phone Link on all Windows machines, enforce hardware‑based MFA, and block CloudZ RAT traffic.
Summary
CloudZ RAT’s latest version introduces the Pheno plugin, which hijacks Microsoft Phone Link to read its local SQLite database and harvest SMS and one‑time passwords without compromising the mobile device. The RAT also targets browser data, host profiles, and can execute file operations, shell commands, screen recording, and plugin management. The infection chain starts when a victim runs a fake ScreenConnect update that drops a Rust‑based loader, followed by a .NET loader that installs the RAT and creates a scheduled task for persistence. The .NET loader includes anti‑analysis checks for sandbox tools, VM strings, and time‑based evasion, while the RAT rotates three hardcoded user‑agent strings and adds anti‑caching headers to HTTP requests to avoid CDN caching of C2 or staging server details. Cisco Talos has published IOCs such as URLs, hashes, domains, and IPs for defenders to block. Defenders are advised to disable Microsoft Phone Link, avoid SMS‑based OTP services, use authenticator apps that do not rely on push notifications, and consider hardware keys for phishing‑resistant MFA.
Key changes
- Pheno plugin hijacks Microsoft Phone Link and reads its SQLite database to steal SMS and OTPs
- CloudZ RAT installs via a Rust loader then a .NET loader that creates a scheduled task for persistence
- The .NET loader performs anti‑analysis checks for sandbox tools, VM strings, and time‑based evasion
- RAT rotates three hardcoded user‑agent strings and adds anti‑caching headers to HTTP requests
- Infection begins with a fake ScreenConnect update that drops the Rust loader
- CloudZ can execute file operations, shell commands, screen recording, and plugin management