CloudZ RAT Pheno Plugin: Hijacking Microsoft Phone Link for OTP Theft — Detection and Mitigation

---
title: CloudZ RAT Pheno Plugin - Suspicious Access to Phone Link LocalState
id: 89c3d2a1-5f4b-4c8a-9b1e-0f7a8e6d5c4b
status: experimental
description: Detects processes, other than PhoneLink itself, accessing the Phone Link LocalState directory where SMS/OTP data may be stored or cached. This behavior is indicative of the CloudZ Pheno plugin attempting to steal messages.
references:
  - https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/
author: Security Arsenal
date: 2025/04/03
tags:
  - attack.credential_access
  - attack.t1112
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains: '\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\'
  filter_legit:
    Image|endswith:
      - '\PhoneLink.exe'
      - '\YourPhone.exe'
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate backup tools scanning user profile directories
level: high
---
title: Potential CloudZ RAT Execution - Suspicious Parent Process
id: b4f1e9a2-6d8c-4e3f-9a2b-1c5d6e8f9a0b
status: experimental
description: Detects suspicious child processes often spawned by CloudZ RAT, such as PowerShell or cmd, with network connectivity indicators, originating from a user directory.
references:
  - Internal threat research on CloudZ RAT
author: Security Arsenal
date: 2025/04/03
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: '\AppData\'
    ParentImage|endswith:
      - '.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  selection_network:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'IEX'
  condition: all of selection_*
falsepositives:
  - Administrative scripting
level: medium

// Hunt for processes accessing Phone Link data directories
DeviceFileEvents
| where FolderPath endswith @"\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState"
| where InitiatingProcessFileName !in ("PhoneLink.exe", "YourPhone.exe", "explorer.exe", "SearchIndexer.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

-- Hunt for CloudZ RAT persistence and artifacts in user profiles
-- CloudZ often creates persistence in Startup or hidden AppData folders
LET SuspiciousPaths = glob(globs="""C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk""")
SELECT 
  OSPath,
  Size,
  Mode.String AS Mode,
  Mtime AS ModifiedTime,
  Atime AccessedTime
 FROM glob(globs=C:\Users\*\AppData\**\*.exe)
WHERE 
  -- Look for executables in AppData that are NOT signed or have random names
  Name =~ "[a-z0-9]{8,}\.exe" 
  OR Name =~ "[A-Z]{2}[0-9]{6}\.exe"
  AND Mtime < now() - 24h
-- Limit to recent activity to reduce noise
LIMIT 50

<#
.SYNOPSIS
    CloudZ RAT / Phone Link Hardening Script
.DESCRIPTION
    This script checks for the presence of the Microsoft Phone Link app 
    and offers to disable it via the registry to mitigate the Pheno plugin attack vector.
    It also checks for unsigned executables in common startup locations.
#>

Write-Host "[+] Starting CloudZ RAT Mitigation and Phone Link Hardening..." -ForegroundColor Cyan

# 1. Check if Phone Link is installed
$phoneLinkApp = Get-AppxPackage -Name *YourPhone* -ErrorAction SilentlyContinue

if ($phoneLinkApp) {
    Write-Host "[!] Microsoft Phone Link is detected." -ForegroundColor Yellow
    Write-Host "    Recommendation: Disable Phone Link if SMS OTP interception is a concern." -ForegroundColor White
    
    # Disable via Registry (Prevents auto-start and pairing)
    $registryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\YourPhone"
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force | Out-Null
    }
    
    # Set a value to disable the feature (simulating unpairing/disabling)
    # Note: A full disable requires removing the AppxPackage, which requires Admin.
    # This registry check mitigates the 'automatic' connection aspect.
    Write-Host "[*] Checking registry configuration..." -ForegroundColor Gray
    
    # 2. Hunt for Suspicious Startup Items (CloudZ Persistence)
    Write-Host "[*] Scanning User Startup folders for unsigned executables..." -ForegroundColor Gray
    $startupPath = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
    if (Test-Path $startupPath) {
        Get-ChildItem -Path $startupPath -Filter *.lnk | ForEach-Object {
            $sh = New-Object -ComObject WScript.Shell
            $target = $sh.CreateShortcut($_.FullName).TargetPath
            if ($target -and (Test-Path $target)) {
                $sig = Get-AuthenticodeSignature -FilePath $target
                if ($sig.Status -ne "Valid") {
                    Write-Host "[ALERT] Unsigned/Invalid signature found in Startup: $target" -ForegroundColor Red
                }
            }
        }
    }

} else {
    Write-Host "[+] Microsoft Phone Link not detected. System is safe from this specific vector." -ForegroundColor Green
}

Write-Host "[+] Hardening Script Complete." -ForegroundColor Cyan