New Scam Alert: Criminals Exploiting Microsoft Phone Link to Steal Verification Codes

At TCT Federal Credit Union, we work hard to keep our members informed about the latest fraud trends.

Security researchers recently uncovered a new scam that targets Microsoft’s Phone Link application, a tool that connects your smartphone to your Windows computer. The scam allows criminals to steal text messages and verification codes—even without directly infecting your phone. ^1,2

What Is Microsoft Phone Link?

Microsoft Phone Link (formerly "Your Phone") allows users to sync their smartphone with a Windows computer. Once connected, you can view text messages, notifications, calls, and other phone activity directly from your PC. ^1,2

While Phone Link is a legitimate and useful tool, cybercriminals are now abusing it when they gain access to an infected computer. ^1,2

How the Scam Works

Researchers discovered a remote access malware program known as CloudZ RAT that uses a malicious plugin called Pheno to monitor active Phone Link connections.

Once a Windows computer is infected:

1. The computer becomes compromised. Criminals install malware through phishing emails, fake software updates, or other malicious downloads. ^1,2
2. The malware watches for Phone Link activity. The Pheno plugin scans the computer for active Phone Link sessions between the PC and smartphone. ^1,3
3. Text messages and notifications are copied. Phone Link stores synchronized information on the computer. The malware can access those local files and capture SMS messages, notification content, and verification codes. ^1,2 
4. Two-factor authentication (2FA) protections are bypassed. If your bank, email provider, or other services send one-time passcodes by text message, criminals may be able to intercept those codes from the infected computer without ever touching your phone. ^1,2,4 

Why This Matters

Many people assume that if their phone is secure, their text-message verification codes are safe. This attack demonstrates that when a phone is synced to a compromised Windows computer, the PC can become the weak link in the security chain. ^3,4

This scam does not involve a vulnerability in Phone Link itself. Instead, criminals are abusing legitimate data that Phone Link has already synchronized to an infected computer. ^2,5

How to Protect Yourself

Keep Your Computer Protected

• Use reputable antivirus and anti-malware software.
• Install Windows security updates promptly.
• Be cautious when opening email attachments or downloading software updates from unknown sources.

Review Connected Devices

• Open Microsoft Phone Link and verify that only devices you recognize are linked.
• Remove old, unused, or unfamiliar devices from your Phone Link account and Bluetooth settings.

Disable Phone Link When Not Needed

• Close the application when you're not actively using it.
• Consider turning off Bluetooth if you do not need continuous device syncing.

Strengthen Your Authentication Methods

• Whenever possible, use an authenticator app or hardware security key instead of SMS-based verification codes.
• Avoid relying solely on text-message authentication for critical accounts. ⁴

Watch for Signs of Malware

Contact a trusted IT professional if you notice:

• Unexpected pop-ups
• Slow computer performance
• Unknown programs running in the background
• Security software being disabled
• Unusual login alerts from your online accounts

What TCT Members Should Remember

TCT Federal Credit Union will never call, text, or email you asking for:

• One-time passcodes
• Verification codes
• Online banking passwords
• Secure access codes

If anyone requests this information, it is likely a scam.

Helpful Resources

• Cisco Talos Research on CloudZ RAT
• The Hacker News Coverage of the Attack
• Stay Safe Online
• Microsoft Support

Think You May Have Been Affected?

If you believe your computer may be infected or if you've shared verification codes with a scammer, act quickly:

1. Disconnect the device from the internet.
2. Run a full antivirus scan.
3. Change passwords for important accounts.
4. Contact TCT Federal Credit Union immediately if you notice suspicious activity on your accounts.

Staying informed is one of the best ways to protect yourself. When it comes to fraud prevention, a little caution can go a long way.

Cited Sources:

1 = Blog Talos Intelligence 

2 = The Hacker News 

3 = Cyber Security News 

4 = Windows Report 

5 = Digital Warfare

Share: Share on Facebook: New Scam Alert: Criminals Exploiting Microsoft Phone Link to Steal Verification Codes Share on Twitter: New Scam Alert: Criminals Exploiting Microsoft Phone Link to Steal Verification Codes