{"id":16172,"date":"2026-05-05T11:06:11","date_gmt":"2026-05-05T11:06:11","guid":{"rendered":"https:\/\/newestek.com\/?p=16172"},"modified":"2026-05-05T11:06:11","modified_gmt":"2026-05-05T11:06:11","slug":"stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16172","title":{"rendered":"Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

A newly identified malware campaign is abusing Microsoft\u2019s Phone Link feature to intercept SMS-based one-time passwords and other sensitive mobile data directly from Windows systems.<\/p>\n

The activity, first observed by Cisco Talos in January 2026, involves a remote access trojan dubbed CloudZ and a custom plugin named Pheno that together allow attackers to harvest credentials and potentially capture authentication codes synced from a user\u2019s smartphone, Talos researchers Alex Karkins and Chetan Raghuprasad wrote in a blog post.<\/p>\n

\u201cAccording to the functionalities of the CloudZ RAT and Pheno plugin, this was with the intention of stealing victims\u2019 credentials and potentially one-time passwords (OTPs),\u201d the researchers wrote.<\/p>\n

The attack does not target the mobile device itself. Instead, it exploits the trust relationship between phones and Windows PCs by monitoring data mirrored through the Phone Link application, the blog post said.<\/p>\n

CloudZ \u201cutilizes the custom Pheno plugin to hijack the established PC-to-phone bridge by abusing the Microsoft Phone Link application, allowing the plugin to continuously scan for active Phone Link processes and potentially intercept sensitive mobile data like SMS and OTPs without deploying malware on the phone,\u201d the Talos report said.<\/p>\n

The technique sidesteps the need to compromise the mobile device itself, which the researchers said makes the intrusion notable to enterprise defenders.<\/p>\n

It adds to a growing body of attacker tradecraft aimed at bypassing<\/a> SMS- and app-based MFA by extracting authentication codes from compromised Windows systems where mobile data is synced.<\/p>\n

Microsoft did not immediately respond to a request for comment.<\/p>\n