Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks

This article discusses a social engineering campaign leveraging Obsidian plugins to deliver a novel RAT malware targeting finance and cryptocurrency professionals.

• •REF6598 campaign exploits Obsidian's community plugin ecosystem, specifically Shell Commands and Hider plugins, to execute malicious code when victims open shared cloud vaults
• •Attackers use social engineering through LinkedIn and Telegram, impersonating venture capital firms, convincing targets to enable community plugin sync which triggers malware execution
• •PHANTOMPULSE is an AI-generated backdoor using Ethereum blockchain to resolve command-and-control servers, communicating via WinHTTP to exfiltrate data and receive commands
• •On Windows, the attack chain uses PowerShell scripts to deploy an intermediate loader that decrypts and executes PHANTOMPULSE in memory with capabilities including shellcode injection, file dropping, screenshots, keylogging, and privilege escalation