Cybersecurity — 2026-04-16

Elastic Security discloses PHANTOMPULSE RAT abusing Obsidian plugin for crypto/finance targeting

Elastic Security Labs detailed a campaign (REF6598) that weaponizes Obsidian cross-platform note-taking via its Shell Commands plugin to deploy a previously-undocumented Windows/macOS backdoor called PHANTOMPULSE against finance and cryptocurrency targets. Operators impersonate VC firms on LinkedIn and Telegram, route victims to an attacker-controlled cloud vault, and execute via signed Electron binaries, evading parent-process detection. The RAT uses Ethereum blockchain lookups of a hard-coded wallet address to resolve C2. The Hacker News and Elastic identify it as AI-generated code.

Analysis
The tradecraft innovation is Ethereum-based C2 resolution: hardcoded wallet transaction lookups yield domain-agnostic infrastructure immune to DNS sinkholing with no hosting chokepoint, while retaining low-latency update capability. Obsidian vault delivery precision-matches a target cohort already conditioned to cloud-sync notes in business contexts, reducing social-engineering friction to near-zero. Per Elastic Security Labs primary research, PHANTOMPULSE code appears AI-generated, enabling rapid polymorphic variant production that outpaces signature-based detection. Obsidian's plugin-sandbox model does not assume malicious vault authorship, and additional detection-evasion innovations targeting that ecosystem are likely within the next quarter.

2 sources

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT - Elastic Security Labs
Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks - The Hacker News