Hackers use Obsidian plugins to spread the PHANTOMPULSE Trojan

Deep Tide TechFlow news. On April 15, according to disclosures from Elastic Security Labs, threat actors impersonate risk investment companies and lure targets into opening Obsidian note repositories containing malicious code via LinkedIn and Telegram. This attack uses Obsidian’s Shell Commands plugin, so malicious payloads can be executed without exploiting vulnerabilities when the victim opens the note repository.

PHANTOMPULSE discovered in the attack is a previously unrecorded Windows remote access trojan (RAT). It achieves blockchain C2 communications through Ethereum transaction data. The macOS payload uses an obfuscated AppleScript deliverer, with a Telegram channel as a backup C2. Elastic Defend detected and blocked the attack in time before PHANTOMPULSE could execute.