Home / Technology / Malware Hijacks Phone Link App for Data Theft
Malware Hijacks Phone Link App for Data Theft
5 May
Summary
- CloudZ Trojan steals credentials via Microsoft Phone Link.
- Malware exploits PC-to-phone connections for data exfiltration.
- Cross-device syncing attacks bypass two-factor authentication.
Researchers have uncovered CloudZ, a sophisticated Remote Access Trojan (RAT) that targets users through the Microsoft Phone Link application. This preinstalled Windows utility connects smartphones to PCs, enabling data transfer. CloudZ, however, exploits this connection by monitoring for active Phone Link sessions.
Once an active session is detected, the Trojan attempts to intercept the app's SQLite database. This allows it to steal sensitive information, including credentials, SMS messages, and one-time passcodes, as data moves between devices. The malware employs various defenses against detection and analysis.
This attack method bypasses standard security measures like two-factor authentication by compromising the connection between trusted devices. It underscores the significant risks associated with cross-device syncing and the evolving tactics of cybercriminals.
