Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs

title: AHackaday IOC starter detection id: ahackaday-2026-05-06-windows-phone-link-exploited-by-cloudz-rat-to-steal-credentials-and-otps-e7f4be65 description: IOC starter rule for Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs status: experimental author: ahackaday logsource: product: network detection: selection_iocs: - "https://thehackernews.com/2026/05/windows-phone-link-exploited-by-cloudz.html" - "thehackernews.com" - "windows-phone-link-exploited-by-cloudz.html" condition: selection_iocs falsepositives: - unknown level: medium

rule ahackaday_2026_05_06_windows_phone_link_exploited_by_cloudz_rat_to_steal_credentials_and_otps_e7f4be65 { meta: description = "IOC starter for Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs" author = "ahackaday" strings: $ioc1 = "https://thehackernews.com/2026/05/windows-phone-link-exploited-by-cloudz.html" nocase $ioc2 = "thehackernews.com" nocase $ioc3 = "windows-phone-link-exploited-by-cloudz.html" nocase condition: any of them }