Malware Hijacks Phone Link for OTP Theft

Post LinkedIn

🖥️Read original on Computerworld

#malware #mfa-bypass #rat #endpoint-securitymicrosoft-phone-linkmicrosoft phonelink cloudz pheno cisco-talos

💡Malware steals OTPs via Phone Link—secure enterprise Windows now

⚡ 30-Second TL;DR

What Changed

CloudZ RAT uses Pheno to scan and hijack Phone Link processes

Why It Matters

Enterprises relying on SMS MFA risk credential theft from compromised Windows systems. Shifts security focus from mobiles to managed PCs, challenging endpoint defenses. Contributes to evolving MFA bypass tactics.

What To Do Next

Audit and disable Phone Link on Windows dev machines using SMS MFA.

Who should care:Enterprise & Security Teams

Key Points

•CloudZ RAT uses Pheno to scan and hijack Phone Link processes
•Intercepts SMS OTPs from Phone Link's local SQLite database
•Infection via Rust-compiled loader disguised as ScreenConnect update
•Establishes persistence with 'SystemWindowsApis' scheduled task
•Exploits PC-phone trust without mobile compromise

🧠 Deep Insight

AI-generated analysis for this event.

🔑 Enhanced Key Takeaways

•The campaign specifically targets the 'notifications.db' SQLite file located within the Phone Link app's local AppData directory, which stores unencrypted SMS content synced from the mobile device.
•The Pheno plugin utilizes a custom-built API hooking mechanism to monitor the Phone Link process in real-time, allowing for immediate exfiltration of OTPs the moment they are received, rather than relying on periodic database dumps.
•Cisco Talos researchers noted that the Rust-based loader employs advanced anti-analysis techniques, including dynamic API resolving and a multi-stage decryption routine that checks for the presence of specific virtualization drivers before executing the payload.

🛠️ Technical Deep Dive

•Loader Architecture: Compiled in Rust to evade signature-based detection; utilizes a custom obfuscator for the final payload.
•Persistence Mechanism: Creates a scheduled task named 'SystemWindowsApis' that triggers on user logon, executing a PowerShell script to re-inject the Pheno plugin into the Phone Link process.
•Data Exfiltration: The Pheno plugin hooks 'Windows.UI.Notifications.ToastNotification' events to intercept incoming SMS notifications before they are rendered to the user.
•Database Access: Directly queries the SQLite database located at '%LocalAppData%\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\notifications.db' using standard SQL commands to extract message history.

🔮 Future ImplicationsAI analysis grounded in cited sources

Microsoft will implement mandatory encryption for the Phone Link local notification database.

The exposure of unencrypted sensitive SMS data on Windows endpoints creates a significant compliance risk for enterprise environments, forcing a security update.

Endpoint Detection and Response (EDR) vendors will introduce specific behavioral rules for Phone Link process monitoring.

The abuse of legitimate system processes like Phone Link for credential theft is becoming a common TTP, necessitating specialized heuristic detection.