CloudZ malware is reportedly abusing a phone link feature to steal sms one-time passwords (otps). The malware, described as a remote access trojan (rat), may be exploiting a vulnerability in microsoft's phone link feature on windows to access mobile notifications and bypass two-factor authentication. The extent of the malware's capabilities and the scope of the attacks are not entirely clear, with some reports suggesting it can also steal other types of texts and credentials.