Cisco Talos discovered an ongoing intrusion campaign where an unknown attacker deployed the CloudZ RAT alongside a novel plugin called 'Pheno'. This plugin is designed to steal OTP messages, which could facilitate unauthorized access to accounts protected by multi-factor authentication. The campaign has been active since at least January 2026. No affected product versions or patches have been identified, and the CloudZ RAT is not a cloud service. The technical details are documented in a Cisco Talos blog post dated May 2026.

The primary impact is the potential theft of OTP messages, which could undermine multi-factor authentication security and enable attackers to bypass additional authentication layers. This could lead to unauthorized access to sensitive accounts or systems where OTPs are used. There is no indication of broader system compromise or other payloads beyond the RAT and Pheno plugin from the provided data.

No patch or official remediation is currently documented for this threat. Organizations should monitor Cisco Talos advisories for updates. Given the nature of the threat, reviewing and enhancing OTP delivery security and monitoring for unusual RAT activity may be prudent. However, no vendor advisory or patch information is available to confirm specific remediation steps at this time.