Hackers use Obsidian plugins to deploy the PHANTOMPULSE Trojan

robot
Abstract generation in progress

ME News, April 15 (UTC+8). According to Elastic Security Labs, threat actors impersonate venture capital firms and lure targets into opening Obsidian note repositories containing malicious code via LinkedIn and Telegram. This attack uses Obsidian’s Shell Commands plugin and does not require exploiting any vulnerabilities to execute the malicious payload when the victim opens the note repository.

PHANTOMPULSE found in the attack is a previously undocumented Windows remote access Trojan (RAT) that communicates with blockchain C2 through Ethereum transaction data. The macOS payload uses an obfuscated AppleScript dropper and uses a Telegram channel as a backup (fallback) C2. Elastic Defend detected and blocked the attack in time before PHANTOMPULSE could execute. (Source: ODAILY)

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin