The app supports Android and iOS and can be used to answer calls, reply to text messages from your computer, and receive notifications. On Android, you can also view and share your camera reel.

CloudZ is a modular Remote Access Trojan (RAT), compiled as a .NET executable and equipped with a range of defenses against analysis and reverse engineering, including obfuscation and the detection of debuggers and profilers in its environment.

The malware loads its instructions into memory during execution, establishes a connection to a command-and-control (C2) server, and executes PowerShell scripts to extract, download, and exfiltrate data to the attacker-controlled C2 server.

While the researchers did not document any specific methods of initial intrusion, if CloudZ has infected a Windows PC, the Trojan can spy on these systems using the newly discovered "Pheno" plugin. Pheno is a malicious module in CloudZ that's designed to monitor and scan for active Phone Link processes.