A recent threat intelligence report from Elastic Security Labs reveals that a novel malware campaign has been identified that exploits Obsidian's community plugin ecosystem to distribute a previously undocumented Windows remote access trojan (RAT) called PHANTOMPULSE. This campaign leverages social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems, ultimately distributing the PHANTOMPULSE RAT in targeted finance and cryptocurrency attacks.
To learn more about this threat and how to protect against it, please visit for an exclusive analysis from Elastic Security Labs.
Obsidian, a popular note-taking application, has been exploited by threat actors as an initial access vector in targeted finance and cryptocurrency attacks.
The attackers use social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems.
The attack leverages Obsidian's legitimate community plugin ecosystem to distribute a previously undocumented Windows remote access trojan (RAT) called PHANTOMPULSE.
PHANTOMPULSE uses the Ethereum blockchain for resolving its command-and-control (C2) server and employs WinHTTP for communications, allowing it to send system telemetry data, fetch commands, and transmit execution results.
The malware has various supported commands, including inject, drop, screenshot, keylog, uninstall, elevate, and downgrade, to facilitate comprehensive remote access.
Obsidian, a popular cross-platform note-taking application, has been exploited by threat actors as an initial access vector in a targeted finance and cryptocurrency attack campaign. According to the latest security intelligence report from Elastic Security Labs, this novel social engineering campaign leverages Obsidian's legitimate community plugin ecosystem to distribute a previously undocumented Windows remote access trojan (RAT) called PHANTOMPULSE.
The REF6598 campaign, which has been observed abusing Obsidian's community plugin feature as an initial access vector, employs elaborate social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems. The attackers approach prospective individuals under the guise of a venture capital firm and then move the conversation to a Telegram group where several purported partners are present.
The Telegram group chat is engineered to lend the operation a smidgen of credibility, with the members discussing topics related to financial services and cryptocurrency liquidity solutions. The target is then instructed to use Obsidian to access what appears to be a shared dashboard by connecting to a cloud-hosted vault using the credentials provided to them.
It's this vault that triggers the infection sequence. As soon as the vault is opened in the note-taking application, the target is asked to enable "Installed community plugins" sync, effectively causing malicious code to be executed. This technique abuses Obsidian's legitimate community plugin ecosystem, specifically the Shell Commands and Hider plugins, to silently execute code when a victim opens a shared cloud vault.
"The threat actors abuse Obsidian's legitimate community plugin ecosystem, specifically the Shell Commands and Hider plugins, to silently execute code when a victim opens a shared cloud vault," researchers Salim Bitam, Samir Bousseaden, and Daniel Stepanic said in a technical breakdown of the campaign. "This attack requires social engineering to cross the community plugin sync boundary, but the technique remains notable: it abuses a legitimate application feature as a persistence and command execution channel."
The payload lives entirely within JSON configuration files that are unlikely to trigger traditional antivirus signatures, and execution is handed off by a signed, trusted Electron application, making parent-process-based detection the critical layer. Dedicated execution paths are activated depending on the operating system.
On Windows, the commands are used to invoke a PowerShell script to drop an intermediate loader codenamed PHANTOMPULL that decrypts and launches PHANTOMPULSE in memory. PHANTOMPULSE is an artificial intelligence (AI)-generated backdoor that uses the Ethereum blockchain for resolving its command-and-control (C2) server by fetching the latest transaction associated with a hard-coded wallet address.
Upon obtaining the C2 address, the malware uses WinHTTP for communications, allowing it to send system telemetry data, fetch commands and transmit the execution results, upload files or screenshots, and capture keystrokes. The supported commands are designed to facilitate comprehensive remote access:
* inject, to inject shellcode/DLL/EXE into target process
* drop, to drop a file to disk and execute it
* screenshot, to capture and upload a screenshot
* keylog, to start/stop a keylogger
* uninstall, to initiate removal of persistence and perform cleanup
* elevate, to escalate privileges to SYSTEM via the COM elevation moniker
* downgrade, to transition from SYSTEM to elevated admin
On macOS, the Shell Commands plugin delivers an obfuscated AppleScript dropper that iterates over a hard-coded domain list, while employing Telegram as a dead drop resolver for fallback C2 resolution. This approach also offers added flexibility as it makes it possible to easily rotate C2 infrastructure, rendering domain-based blocking insufficient.
In the final step, the dropper script contacts the C2 domain to download and execute a second-stage payload via osascript. The exact nature of this payload remains unknown given that the C2 servers are currently offline. The intrusion was ultimately unsuccessful, as the attack was detected and blocked before the adversary could accomplish their goals on the infected machine.
"REF6598 demonstrates how threat actors continue to find creative initial access vectors by abusing trusted applications and employing targeted social engineering," Elastic said. "By abusing Obsidian's community plugin ecosystem rather than exploiting a software vulnerability, the attackers bypass traditional security controls entirely, relying on the application's intended functionality to execute arbitrary code."
A recent threat intelligence report from Elastic Security Labs reveals that a novel malware campaign has been identified that exploits Obsidian's community plugin ecosystem to distribute a previously undocumented Windows remote access trojan (RAT) called PHANTOMPULSE. This campaign leverages social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems, ultimately distributing the PHANTOMPULSE RAT in targeted finance and cryptocurrency attacks.
To learn more about this threat and how to protect against it, please visit for an exclusive analysis from Elastic Security Labs.
