Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks

Elastic Security Labs observed a targeted social-engineering campaign leveraging LinkedIn and Telegram to lure financial and crypto professionals into opening a malicious Obsidian cloud vault that abuses the app's community plugin sync to execute a novel remote access trojan called PHANTOMPULSE. The backdoor—cross-platform with Windows and macOS execution paths—uses blockchain-based C2 resolution, supports injection, file drop, screenshots, keylogging and privilege escalation, but the documented intrusion was detected and blocked before the attackers achieved their objectives.