PHANTOMPULSE RAT Targets Crypto Pros via Obsidian

Security researchers have uncovered a sophisticated social engineering campaign targeting cryptocurrency and finance professionals, using the note-taking application Obsidian to deploy a previously unknown remote access trojan called PHANTOMPULSE. The attacks, detailed in a report released Tuesday by Elastic Security Labs, begin on LinkedIn and shift to Telegram, exploiting trusted productivity tools to bypass conventional security measures.

Attackers initiate contact on LinkedIn by impersonating representatives from venture capital firms, focusing on discussions about cryptocurrency liquidity solutions and financial services. Once trust is built, conversations move to Telegram group chats involving multiple fake profiles to create a credible business environment. Victims are then instructed to access a shared dashboard or database via Obsidian, presented as an enterprise-grade tool for collaboration. They receive login credentials for a cloud-hosted vault controlled by the attackers.

Upon opening the vault in Obsidian, users are prompted to enable community plugin synchronization, a feature disabled by default. This action triggers the installation of malicious plugins,...