Continuous-variable quantum-key distribution based on the local-oscillator approach has been encountered with new security issues due to reference pulses transmitted over insecure quantum channels. Herein, a attack method for eavesdropping and tampering with phases of reference pulses is proposed, allowing the phase-compensation error in the receiver to be increased and secure-key rate of practical systems to be decreased. The secure-key rate of a practical system under phase attack of reference pulses is analyzed using the phase-compensation noise model. Moreover, a method for detecting phase attack is proposed, wherein the phase-compensation-noise variances are monitored. Simulation results show that the secure-key rate estimated by training signals is consistent with its theoretical value, and phase attack can be detected by monitoring phase-compensation-noise variances of the training signals and reference pulses.