Experts warn Microsoft Phone Link tool exploited by 'unknown threat' to steal SMS and OTP info

A known RAT was given new capabilities

by · TechRadar

News By Sead Fadilpašić published 6 May 2026

(Image credit: Getty Images)

Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter

  • A new CloudZ plugin, Pheno, hijacks Microsoft Phone Link to steal SMS and OTPs from connected Android devices
  • This enables attackers to bypass 2FA without compromising the phone itself
  • The RAT retains full remote access capabilities, with researchers urging a shift away from SMS‑based authentication

A new version of the CloudZ remote access trojan (RAT) for Windows now comes with a new plugin that steals data from a connected Android device, experts have revealed.

Security researchers Cisco Talos recently spotted the upgraded variant while investigating a breach that has been ongoing since January 2026.

Windows 10 and 11 operating systems have a feature called Microsoft Phone Link, which allows users to connect their Android and iOS mobile devices to their computers. They can then use their computers to take and make calls, text people, and more, without needing to pick up the smartphone.

Article continues below

Stealing 2FA and OTPs

While it’s definitely a handy feature to answer those group WhatsApp and Telegram messages, it is even more handy when the device is needed for two-factor authentication (2FA). However, this is precisely why CloudZ was introduced with a new plugin called Pheno.

Which brings us to today.

By hijacking the connection, the threat actors can easily exfiltrate not just credentials, but also temporary passwords that get sent to the mobile device - without needing to compromise the phone.

Pheno works by monitoring for active Phone Link sessions and accessing the local SQLite database that contains SMS and one-time passwords (OTP).

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors