Cisco Talos Uncovers Phone Link Malware Campaign

Cybersecurity researchers at Cisco Talos have uncovered a malware campaign active since at least January 2026 that uses a remote access trojan called CloudZ and an undocumented plugin named Pheno to steal credentials and intercept SMS messages and one-time passwords from victims' Windows machines. The tools exploit Microsoft Phone Link, a built-in feature in Windows 10 and 11, without requiring attackers to compromise the paired mobile device.

Phone Link, formerly known as Your Phone, connects a Windows PC to an Android or iOS smartphone over Wi-Fi and Bluetooth, mirroring calls, messages, and notifications to the desktop. This data syncs to local SQLite database files on the PC, including PhoneExperiences.db. Pheno scans running processes for keywords such as YourPhone, PhoneExperienceHost, and Link to Windows. Upon detecting an active session, indicated by the string "proxy" in process output, it tags the system as "Maybe connected" and enables access to the database, potentially capturing authentication codes and SMS content.

The infection chain begins with a fake update for ScreenConnect, a legitimate remote support tool. This drops a Rust-compiled loader, often named...