Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

Elastic Security Labs describes REF6598, a targeted social engineering campaign that abuses Obsidian community plugins to execute attacker-controlled code and deliver a sophisticated cross-platform backdoor. The report analyzes a Windows in-memory loader (PHANTOMPULL) and the PHANTOMPULSE RAT — which uses reflective DLL loading, advanced injection techniques, and a blockchain-based C2 rotation mechanism — as well as a macOS AppleScript dropper with Telegram fallback, and provides indicators, detection guidance, and noted weaknesses in the malware's C2 design.