Attacks Abuse Windows Phone Link to Steal Texts & Bypass 2FA

Summary

Attackers are leveraging the Windows Phone Link application—a legitimate Windows-based bridge connecting PCs to Android smartphones—to deploy the CloudZ RAT malware and a new plugin called Pheno. The attack chain allows adversaries to intercept SMS messages and bypass two-factor authentication mechanisms. These attacks are difficult to detect due to the legitimate nature of the Phone Link application.

Indicators of Compromise

• malware — CloudZ RAT
• malware — Pheno

Entities