Hackers used the Obsidian plugin to launch the PHANTOMPULSE Trojan.

According to a report by Elastic Security Labs, as reported by Odaily, threat actors impersonated venture capital firms and lured targets to open Obsidian notes containing malicious code via LinkedIn and Telegram. This attack utilized Obsidian's Shell Commands plugin to execute a malicious payload without exploiting vulnerabilities when the victim opened the notes library. The attack discovered PHANTOMPULSE, a previously undocumented Windows Remote Access Trojan (RAT), enabled blockchain C2 communication via Ethereum transaction data. The macOS payload used an obfuscated AppleScript delivery tool and a Telegram channel as a backup C2. Elastic Defend detected and blocked the attack before PHANTOMPULSE could execute.