As cited
Copy frozen at (site build).
threat intel
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
Elastic Security Labs identified a social engineering campaign that leverages Obsidian's community plugin ecosystem to distribute PhantomPulse remote access trojan (RAT). The attack targets financial and cryptocurrency sector professionals through LinkedIn and Telegram with elaborate pretexts designed to trick them into installing malicious plugins.
Why it matters: Finance and cryptocurrency professionals are at immediate risk of account compromise and data theft if they install plugins from untrusted sources; practitioners should educate users on plugin vetting and restrict Obsidian plugin installation policies.
- Source published
- First seen by Cybersecurity Tracker