Security researchers have identified a highly targeted social engineering campaign (REF6598) that weaponizes the Obsidian note-taking application to deliver a previously undocumented Remote Access Trojan (RAT) named PHANTOMPULSE. The campaign targets individuals in the financial and cryptocurrency sectors on both Windows and macOS. Attackers use platforms like LinkedIn and Telegram to build trust before luring victims into a malicious shared Obsidian vault. The attack chain relies on tricking the user into enabling a community plugin, which then executes code to deploy the RAT. PHANTOMPULSE demonstrates advanced capabilities, including using the Ethereum blockchain to dynamically resolve its command-and-control (C2) server address, making it highly resilient to takedowns.
The attack, designated REF6598, is a multi-stage social engineering effort. Threat actors pose as venture capitalists and engage with targets on professional networking sites before moving the conversation to a private Telegram group. The primary lure is an invitation to collaborate via a shared, cloud-hosted Obsidian vault.
Once the victim opens the shared vault, the infection is triggered by social engineering. The victim is prompted to enable the "Installed community plugins" synchronization feature. This seemingly innocuous action, which requires manual user approval, is the key to the compromise. It enables malicious versions of legitimate Obsidian plugins ('Shell Commands' and 'Hider') that are present in the shared vault.
The attack chain differs slightly between Windows and macOS but follows the same general principle:
T1566.002): The attacker uses social engineering on LinkedIn/Telegram to convince the target to open a malicious shared Obsidian vault.T1204.002): The user is manipulated into enabling community plugins within Obsidian. This action executes a malicious script via the compromised 'Shell Commands' plugin.T1055).T1102.002): PHANTOMPULSE uses a novel C2 mechanism. It queries the Ethereum blockchain for the latest transaction from a hard-coded wallet address. The C2 server's IP address is embedded within this transaction data, providing a decentralized and censorship-resistant way for the malware to receive instructions.Once active, PHANTOMPULSE can capture keystrokes, take screenshots, exfiltrate files, and execute arbitrary commands.
A successful compromise gives the attacker full access to the victim's machine. For professionals in finance and crypto, this could lead to the theft of sensitive corporate data, intellectual property, trading strategies, and, most critically, cryptocurrency wallet keys and exchange credentials. The cross-platform nature of the attack broadens its potential victim pool. The use of a blockchain-based C2 demonstrates a high level of sophistication, making the threat infrastructure difficult to disrupt.
Type
process_name
Value
Obsidian.exe
Description
Monitor for Obsidian spawning child processes like powershell.exe, cmd.exe, or osascript.
Type
command_line_pattern
Value
powershell -ExecutionPolicy Bypass
Description
Suspicious PowerShell execution, especially when initiated by a non-standard application like Obsidian.
Type
network_traffic_pattern
Value
Outbound connections to Ethereum blockchain nodes or gateways from unexpected processes.
Description
Could indicate PHANTOMPULSE attempting to resolve its C2 address.
Type
file_path
Value
[Vault]/.obsidian/plugins/
Description
Monitor for the creation or modification of files within the Obsidian plugins directory, especially outside of the official plugin marketplace.
powershell.exe, cmd.exe, bash, osascript). This is highly anomalous behavior.此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。