AI-Generated RAT “PHANTOMPULSE” Targets Crypto Sector via Social Engineering

Elastic Security Labs uncovered REF6598, a targeted campaign that lures victims via LinkedIn/Telegram and weaponizes Obsidian community plugins (Shell Commands and Hider) to silently execute a custom in-memory loader (PHANTOMPULL) that deploys PHANTOMPULSE, an AI-assisted Windows RAT. PHANTOMPULSE uses Ethereum-family blockchains as a decentralized C2 dead drop but contains a parsing flaw enabling defenders to craft transactions to sinkhole infected hosts; recommended mitigations include parent-process-based detection and caution with untrusted plugins and shared vaults.