TLDR Tech / InfoSec
Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs
CloudZ RAT uses a custom Pheno plugin to hijack the Windows Phone Link bridge on compromised Windows 10 and 11 systems, monitor active Phone Link processes, and access the app's SQLite database to steal synchronized SMS and OTP data without infecting the phone. Attackers gain initial access via a fake ConnectWise ScreenConnect executable that drops a .NET loader, which deploys modular CloudZ, connects to C2, and runs commands for credential theft, browser data exfiltration, and screen recording.
Read the full story