Hackers use an Obsidian plugin to deploy the PHANTOMPULSE Trojan

robot
Abstract generation in progress

ME News Report, April 15 (UTC+8), according to Elastic Security Labs, threat actors impersonated venture capital firms and used LinkedIn and Telegram to lure targets into opening Obsidian note repositories containing malicious code. This attack exploited Obsidian’s Shell Commands plugin, allowing malicious payloads to be executed when victims opened the note repository without the need for exploiting vulnerabilities.
The PHANTOMPULSE discovered in the attack is a previously undocumented Windows remote access Trojan (RAT), which communicates with the blockchain via Ethereum transaction data for command and control (C2).
The macOS payload uses obfuscated AppleScript delivery and relies on a Telegram channel as an alternative C2.
Elastic Defend detected and blocked the attack in time before PHANTOMPULSE could execute. (Source: ODaily)

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin