Indicator
Type domain · source intel_report_ingest
Related reports (2)
Title/body text match only.
CloudZ RAT potentially steals OTP messages using Pheno plugin Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool (RAT) and a previously undocumented plugin called “Pheno.” Cisco Talos dis
New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment New Abuse of the ClickOnce Technology: Part 1 | CrowdStrike Blog Featured New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Foreve
Sources / connectors (1)
Deduped connector weight from graph context.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Structured pivots from local graph context.
See edges, pivots, and corroboration at a glance.
Full inspector with neighbor expansion.