Obsidian Plugin Abuse Delivered PhantomPulse RAT to Finance and Crypto Targets

Attackers targeted individuals in the financial and cryptocurrency sectors by posing as a venture capital firm on LinkedIn and shifting conversations to Telegram, where they lured victims into opening an attacker-controlled Obsidian vault. The campaign, tracked as REF6598, did not rely on a software vulnerability; instead, it abused Obsidian’s community plugin synchronization to deliver trojanized Shell Commands and Hider plugins that executed attacker-defined code when enabled.

On Windows, the infection chain downloaded a PowerShell stage that deployed PHANTOMPULL, an in-memory loader used to decrypt and reflectively load the previously undocumented PHANTOMPULSE RAT. On macOS, victims received a multi-stage obfuscated AppleScript dropper that established LaunchAgent persistence and used Telegram as a fallback command-and-control channel. Researchers said PHANTOMPULSE supports process injection, keylogging, screenshots, telemetry collection, and privilege escalation, while resolving C2 through Ethereum transaction data; they also identified a flaw in that blockchain-based mechanism that could let defenders hijack infected implants by publishing a newer crafted transaction to the monitored wallet.