Hackers Exploit Obsidian Plugin to Spread PHANTOMPULSE Trojan with Blockchain C2

Gate News message, April 15 — Elastic Security Labs disclosed that threat actors impersonated venture capital firms to lure targets via LinkedIn and Telegram into opening malicious Obsidian note vaults. The attack leveraged Obsidian's Shell Commands plugin to execute malicious payloads when victims opened the vault, requiring no vulnerability exploitation.

PHANTOMPULSE, a previously undocumented Windows remote access trojan (RAT), was discovered in the attack. It uses blockchain C2 communication via Ethereum transaction data. The macOS payload employed an obfuscated AppleScript dropper with a Telegram channel as a backup C2.

Elastic Defend detected and blocked the attack before PHANTOMPULSE execution.