CloudZ RAT potentially steals OTP messages using Pheno plugin

Cisco Talos identified an intrusion active since at least January 2026 involving the CloudZ remote access tool (RAT) combined with a previously undocumented plugin named 'Pheno'. The Pheno plugin is reported to potentially steal one-time password (OTP) messages, indicating targeted information theft capabilities. No specific affected software versions or patches are currently documented. There is no evidence of known exploits in the wild beyond this discovery. The threat is assessed as medium severity based on the available information.

• blog.talosintelligence.com/cloudz-pheno-infostealer/ (opens in a new tab)

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsAnalysis2026-10-30
• Fresh WordPress Vulnerability in Attackers’ CrosshairsHighVulnerability2026-10-30
• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29