Loading story…
Cisco Talos reported an active intrusion in which an unknown threat actor deployed the CloudZ remote access trojan alongside a previously undocumented plugin called Pheno to steal credentials and potentially capture one-time passwords. The campaign has been active since at least January 2026 and appears to rely on a fake ScreenConnect update, a Rust-based dropper, and a .NET loader that establishes persistence through a scheduled task while abusing regasm.exe as a living-off-the-land binary. Talos said the initial access vector remains unknown, but the malware used layered anti-analysis techniques, decrypted configuration data in memory, and fetched additional configuration from attacker-controlled infrastructure including Cloudflare Workers and Pastebin before communicating with a command-and-control server at 185.196.10.136:8089.
The newly identified Pheno plugin was designed to abuse Microsoft Phone Link, which mirrors mobile notifications and SMS content to Windows devices, allowing the attackers to target data without compromising the victim’s phone directly. Talos found that Pheno monitored for active Phone Link processes, checked for signs of an active proxy relay, and wrote reconnaissance results to staging folders for exfiltration by CloudZ. Researchers assessed that this workflow could expose Phone Link SQLite database content including SMS messages, authenticator notifications, and other OTP-related data, giving attackers a path to bypass or weaken multi-factor authentication protections during credential theft operations.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On publication, Cisco Talos publicly documented the campaign’s tooling and tradecraft, including CloudZ’s anti-analysis features, use of regasm.exe and scheduled tasks for persistence, and retrieval of configuration data from attacker-controlled infrastructure. Talos assessed that the Pheno plugin could abuse Microsoft Phone Link to access mirrored SMS messages, authenticator notifications, and one-time-password-related content from the victim’s Windows system.
Cisco Talos reported that an intrusion involving the CloudZ remote access trojan and a previously undocumented plugin called Pheno had been active since at least January 2026. The attacker used an unknown initial access vector, followed by a fake ScreenConnect update, a Rust-based dropper, and a .NET loader to establish persistence and deploy the malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcedarkwebinformer.com
Open sourcezdnet.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted social-engineering campaign tracked as **REF6598** impersonated a venture-capital firm on LinkedIn and Telegram to target financial and cryptocurrency-sector personnel. Victims were persuaded to synchronize Obsidian community plugins, allowing the attackers to abuse the legitimate Shell Commands and Hider plugins—not an Obsidian vulnerability—to launch a cross-platform payload chain. Windows victims received the in-memory **PHANTOMPULL** loader and the previously undocumented **PHANTOMPULSE** remote-access trojan, while macOS victims received an obfuscated AppleScript dropper, LaunchAgent persistence, and a Telegram dead-drop fallback for command-and-control (C2) resolution. PHANTOMPULSE uses direct syscalls, hardware-breakpoint evasion of AMSI, WLDP, and ETW, process injection, scheduled-task persistence, and a public UAC-bypass technique. It can collect system and wallet data, capture screenshots and keystrokes, execute or inject payloads, and manipulate privileges; its C2 resolver retrieves encoded transaction-input data from Ethereum, Base, and Optimism Blockscout services. The resolver does not authenticate transaction senders, allowing defenders or third parties to potentially sinkhole or hijack it. The activity’s crypto-focused victimology and tradecraft align with North Korea-linked operations that have also used fake developer recruitment projects to deploy macOS RustDoor and Koi Stealer malware for theft of browser, Keychain, SSH, VPN, messaging, and cryptocurrency-wallet data.
Sep 9, 2026
Attackers targeted individuals in the financial and cryptocurrency sectors by posing as a venture capital firm on LinkedIn and shifting conversations to Telegram, where they lured victims into opening an attacker-controlled **Obsidian** vault. The campaign, tracked as **REF6598**, did not rely on a software vulnerability; instead, it abused Obsidian’s community plugin synchronization to deliver trojanized **Shell Commands** and **Hider** plugins that executed attacker-defined code when enabled. On Windows, the infection chain downloaded a PowerShell stage that deployed **PHANTOMPULL**, an in-memory loader used to decrypt and reflectively load the previously undocumented **PHANTOMPULSE RAT**. On macOS, victims received a multi-stage obfuscated AppleScript dropper that established LaunchAgent persistence and used Telegram as a fallback command-and-control channel. Researchers said PHANTOMPULSE supports process injection, keylogging, screenshots, telemetry collection, and privilege escalation, while resolving C2 through Ethereum transaction data; they also identified a flaw in that blockchain-based mechanism that could let defenders hijack infected implants by publishing a newer crafted transaction to the monitored wallet.
Jun 29, 2026
Cisco Talos Incident Response reported that phishing became the leading initial access vector in more than half of investigated incidents, with authentication abuse rising to 65% of cases. The firm highlighted an ongoing QR-code phishing campaign attributed to **UAT-11764** that targeted mainly Australian organizations using compromised Microsoft 365 accounts, tailored PDF attachments, and SharePoint- or other trusted cloud-hosted credential harvesting pages. After stealing credentials, the attackers accessed victim inboxes, created inbox rules to evade detection, and used the compromised accounts to spread additional phishing internally and externally. Talos also warned that phishing-as-a-service platforms such as **ARToken** are expanding attacker capabilities with device-code phishing, token abuse, **OAuth** device authorization flow abuse, persistent access via Primary Refresh Tokens, business email compromise, and SharePoint data exfiltration. In ransomware and pre-ransomware cases, including **Sinobi** and **Warlock** activity, operators maintained stealthy access by abusing legitimate remote management tools such as a trojanized **MeshAgent** binary and **Zoho Assist**. Healthcare was the most targeted sector, and Talos urged organizations to deploy phishing-resistant MFA, improve logging, patch exposed systems faster, and limit outbound email rates to reduce propagation.
Aug 25, 2026