CloudZ exposes weak link in OTP security
Cybercriminals are exploiting Microsoft’s Phone Link app to intercept text messages and one-time passwords from connected smartphones without installing malware on the phone itself, exposing a fresh weakness in cross-device authentication systems. The activity centres on CloudZ, a modular remote access trojan deployed on Windows machines, and a previously undocumented plugin called Pheno. The malware has been observed in an intrusion active since at least January 2026, […]