Security agencies: Hackers are using Obsidian to spread the PHANTOMPULSE Trojan.

According to Huoxun Finance, security research firm Elastic Security Labs disclosed a new social engineering attack campaign targeting individuals in the finance and cryptocurrency industries. Attackers impersonated venture capital firms on LinkedIn and Telegram, tricking targets into opening Obsidian notes containing a malicious payload. This led to the deployment of the previously undetected Windows remote control Trojan, PHANTOMPULSE. The attack doesn't exploit any software vulnerabilities but instead abuses Obsidian's Shell Commands plugin to automatically execute malicious code when the notes library is opened. On macOS, an obfuscated AppleScript dispenser is used in conjunction with a Telegram channel as a backup command control server. On Windows, Ethereum transaction data is used to achieve blockchain-based C2 address resolution.