Technical analysis of the CloudZ RAT malware and the Pheno plugin that intercepts SMS/OTP data directly from paired Windows PCs.
Why the Phone Link Bridge Is an Attractive Target
Windows Phone Link exists to make a paired phone feel like part of the PC: notifications, messages, and calls surface on the desktop so a user never has to pick up the handset. To do that, the phone continuously forwards message content — including one-time passcodes delivered over SMS — to the paired computer, where it is rendered by a trusted Windows component. That design turns the PC into a secondary place where sensitive SMS text lives, often with far weaker protection than the phone itself.
CloudZ RAT takes advantage of exactly this. Instead of attacking the phone or intercepting the mobile carrier, it targets the desktop side of the bridge, where the forwarded messages are already decrypted and waiting to be displayed. An attacker who controls the PC does not need to break SMS encryption or clone a SIM; the OTP arrives at the endpoint on its own.
How the Pheno Plugin Steals OTPs
Pheno is the CloudZ component built specifically to harvest OTP and SMS data from the Phone Link channel. Rather than acting as a generic screen scraper, it reads the message data flowing through the bridge on the PC and extracts the fields an attacker cares about: the sender, the message body, and the short numeric codes used for authentication. Because it operates locally as part of the RAT's plugin set, it can run continuously and pull codes the moment they land.
Advertisement
The practical effect is a real-time feed of incoming passcodes. When a victim triggers a login or a transaction that sends an SMS OTP, the code is captured on the desktop and relayed to the attacker before — or at the same time as — the user sees it. This is what makes the technique dangerous: it collapses the time window that OTPs rely on for safety.
Why This Defeats SMS-Based Two-Factor Authentication
SMS OTP assumes the code only reaches a device the legitimate user physically holds. The Phone Link bridge quietly breaks that assumption by duplicating the code onto a general-purpose computer, and CloudZ RAT weaponizes the duplicate. An attacker who already has the victim's password can now complete "something you have" authentication without ever touching the phone.
- No SIM swap or carrier-level interception is required.
- The phone shows no obvious sign of compromise, since the theft happens on the PC.
- Codes are exfiltrated fast enough to be used inside their short validity window.
Practical Defenses
The strongest structural fix is to move away from SMS as a second factor. App-based authenticators and hardware security keys do not deliver their secrets as forwardable text messages, so a compromised desktop bridge has nothing to scrape. Where SMS cannot be avoided, treat the PC as part of the OTP's attack surface and keep it clean.
Beyond that, reduce what the bridge exposes and watch for the RAT itself:
- Disable or unlink Phone Link on machines that do not genuinely need message mirroring.
- Turn off message and notification syncing if only calls or photos are needed.
- Monitor endpoints for unexpected processes reading Phone Link data or making unusual outbound connections.
- Investigate the initial access path — a RAT on the desktop is the root problem, and the OTP theft is only one thing it can do once resident.