Obsidian Plugin Abuse Delivers PhantomPulse RAT to Crypto Targets

A targeted social-engineering campaign tracked as REF6598 impersonated a venture-capital firm on LinkedIn and Telegram to target financial and cryptocurrency-sector personnel. Victims were persuaded to synchronize Obsidian community plugins, allowing the attackers to abuse the legitimate Shell Commands and Hider plugins—not an Obsidian vulnerability—to launch a cross-platform payload chain. Windows victims received the in-memory PHANTOMPULL loader and the previously undocumented PHANTOMPULSE remote-access trojan, while macOS victims received an obfuscated AppleScript dropper, LaunchAgent persistence, and a Telegram dead-drop fallback for command-and-control (C2) resolution.

PHANTOMPULSE uses direct syscalls, hardware-breakpoint evasion of AMSI, WLDP, and ETW, process injection, scheduled-task persistence, and a public UAC-bypass technique. It can collect system and wallet data, capture screenshots and keystrokes, execute or inject payloads, and manipulate privileges; its C2 resolver retrieves encoded transaction-input data from Ethereum, Base, and Optimism Blockscout services. The resolver does not authenticate transaction senders, allowing defenders or third parties to potentially sinkhole or hijack it. The activity’s crypto-focused victimology and tradecraft align with North Korea-linked operations that have also used fake developer recruitment projects to deploy macOS RustDoor and Koi Stealer malware for theft of browser, Keychain, SSH, VPN, messaging, and cryptocurrency-wallet data.