Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks
Summary: Elastic Security Labs tracked a campaign it calls REF6598 that approached financial and cryptocurrency targets on LinkedIn posing as a venture capital firm, moved them to a Telegram group, and had them open a cloud-hosted Obsidian vault whose community plugin sync executed malicious code through the Shell Commands and Hider plugins. On Windows the chain dropped a loader called PHANTOMPULL that launched the AI-generated backdoor PHANTOMPULSE in memory, resolving its command-and-control server via the Ethereum blockchain, while macOS received an obfuscated AppleScript dropper using Telegram as a fallback resolver; the intrusion was detected and blocked before the adversary reached its goals.
What you should know: The payload lived entirely in JSON configuration files unlikely to trigger antivirus signatures and was executed by a signed, trusted Electron application, leaving parent-process-based detection as the critical layer. Elastic also noted the blockchain resolver has no sender verification, so a defender can override the command-and-control URL for every implant by posting a single transaction.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026