Listen to this Post
Introduction:
A trusted note‑taking app has become the latest vector for a sophisticated, cross‑platform cyberattack. Threat actors are abusing Obsidian’s community plugin ecosystem—specifically the “Shell Commands” and “Hider” plugins—and shared cloud vaults to deliver a previously undocumented remote access trojan (RAT) named PHANTOMPULSE. The campaign, tracked as REF6598, uses multi‑stage social engineering on LinkedIn and Telegram to target professionals in the financial and cryptocurrency sectors.
Learning Objectives:
- Understand how attackers use legitimate Obsidian plugins and shared vaults to execute malicious code without exploiting a vulnerability.
- Learn to detect and analyze the cross‑platform attack chain, including the Windows‑specific PHANTOMPULSE RAT and the macOS AppleScript dropper.
- Acquire hands‑on commands and configuration steps for system hardening, threat hunting, and incident response on both Linux and Windows environments.
You Should Know:
- Anatomy of the Attack Chain: From LinkedIn to Full System Compromise
What it is:
The attack begins with a fake venture capital persona that contacts a target via LinkedIn. After initial engagement, the conversation moves to a Telegram group where several fake “partners” build credibility. The target is then asked to use Obsidian as the firm’s “management database” and is given credentials to an attacker‑controlled cloud vault. Once the vault is opened and the victim enables community plugin sync, the malicious configuration for the Shell Commands and Hider plugins is silently pulled onto the victim’s machine.
How to use it (for detection & analysis):
On Windows, the Shell Commands plugin executes two `Invoke-Expression` calls with Base64‑encoded strings that reach out to a staging server (195.3.222[.]251). A PowerShell script is retrieved, which uses `BitsTransfer` to download a 64‑bit executable named syncobs.exe. This executable—dubbed PHANTOMPULL—decrypts an AES‑256‑CBC‑encrypted payload from its own resources and reflectively loads it entirely into memory, leaving no file on disk.
Detection commands (Windows PowerShell with admin privileges):
Check for suspicious PowerShell processes spawned by Obsidian
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | Where-Object {$_.Message -match "195.3.222.251"}
Look for BitsTransfer jobs downloading suspicious executables
Get-BitsTransfer | Where-Object {$_.FileList -like "syncobs.exe"}
Examine the Obsidian plugins directory for unexpected files
Get-ChildItem -Path "$env:USERPROFILE.obsidian\plugins" -Recurse | Select-Object FullName, LastWriteTime
Linux / macOS detection commands:
Search for Obsidian child processes (macOS)
ps aux | grep -E "(Obsidian|obsidian). (PowerShell|osascript|curl|bash|sh)"
Check for unexpected files in Obsidian plugins directory (Linux)
find ~/.config/obsidian/ -path "/plugins/" -type f -name ".json" -exec grep -l "Invoke-Expression|osascript" {} \;
Monitor for outbound connections to blockchain APIs (Ethereum C2)
sudo tcpdump -i any -n 'host blockscout.com or port 8545' -c 100
- PHANTOMPULSE RAT: A Deep Dive into the AI‑Generated Backdoor
What it is:
PHANTOMPULSE is a full‑featured, AI‑assisted Windows RAT that uses a novel command‑and‑control (C2) resolution technique based on public Ethereum blockchain data. It queries Blockscout APIs across three blockchain networks, reading XOR‑encrypted C2 URLs from the input fields of transactions tied to a hardcoded wallet address. This makes the C2 infrastructure highly resilient to takedowns.
Step‑by‑step guide (analysis & mitigation):
- Extract configuration from memory: Use a memory forensics tool like Volatility to dump the process memory of `Obsidian.exe` or the injected payload.
- Decode the C2 mechanism: Look for strings that reference Ethereum wallet addresses or Blockscout API endpoints. The malware always selects the most recent transaction from the wallet, which provides a mutable C2 URL.
- Block blockchain API traffic: Add firewall rules to deny outbound connections to known blockchain explorers (
blockscout.com,etherscan.io) if not required for business. - Monitor for process injection techniques: PHANTOMPULSE uses module stomping and timer‑queue callbacks to evade detection.
Windows firewall rule to block blockchain C2:
New-NetFirewallRule -DisplayName "Block Blockchain C2" -Direction Outbound -RemoteAddress "151.101.0.0/16","104.16.0.0/12" -Protocol TCP -Action Block
Linux iptables rule:
sudo iptables -A OUTPUT -d 151.101.0.0/16 -j DROP sudo iptables -A OUTPUT -d 104.16.0.0/12 -j DROP
- The macOS Variant: AppleScript Dropper with Telegram Fallback
What it is:
For macOS targets, the Shell Commands plugin executes a Base64‑encoded command that launches an obfuscated AppleScript dropper. This dropper creates a LaunchAgent for persistence and then fetches the next stage through a layered C2 process. If the primary server is unavailable, the malware can fall back to a Telegram‑based dead drop to recover a backup domain.
Step‑by‑step guide (detection & hardening):
- Identify rogue LaunchAgents: Check for unexpected plist files in `~/Library/LaunchAgents/` that reference `osascript` or
curl. - Monitor AppleScript execution: Use `sudo fs_usage -w -f filesys | grep “osascript”` to log all AppleScript invocations.
- Block Telegram API endpoints: Add firewall rules to deny traffic to `api.telegram.org` unless Telegram is a business requirement.
macOS detection commands:
List all LaunchAgents with modification times ls -la ~/Library/LaunchAgents/ Search for suspicious AppleScript commands in recent logs log show --predicate 'process == "osascript"' --last 1h Monitor for outbound connections to Telegram sudo lsof -i | grep -E "(api.telegram|149.154.167)"
- Mitigation and Hardening: How to Protect Your Obsidian Vault
What it is:
Because the attack relies on legitimate features rather than software vulnerabilities, traditional patching is insufficient. Protection requires a combination of policy controls, process monitoring, and network detections.
Step‑by‑step hardening guide:
- Enable Restricted Mode in Obsidian: This disables all community plugins by default.
– Go to Settings → Community plugins → Turn on Restricted mode.
2. Audit and whitelist only essential plugins: Review the `.obsidian/plugins/` folder for any unexpected JSON configuration files.
3. Use endpoint detection and response (EDR) rules: Alert on Obsidian spawning child processes like powershell.exe, cmd.exe, osascript, curl, or wget.
4. Implement network segmentation: Isolate workstations running Obsidian from critical internal systems.
5. Apply Windows Defender Attack Surface Reduction (ASR) rules:
Block PowerShell from spawning from Obsidian Add-MpPreference -AttackSurfaceReductionRules_Ids "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -AttackSurfaceReductionRules_Actions Enabled
5. Training Courses to Defend Against Emerging Threats
What it is:
To stay ahead of evolving tactics like those used in REF6598, security professionals should pursue targeted training in malware analysis, threat hunting, and social engineering defense.
Recommended courses (2026):
- Kaspersky – Targeted Malware Reverse Engineering: Hands‑on course transforming analysis knowledge into practical experience.
- CompTIA CySA+ (CS0-003): Focuses on behavioral analytics to identify and combat malware and APTs across a broad attack surface.
- SEC390 – AI and Machine Learning for Cybersecurity: Teaches how to use AI/ML to detect email threats, APTs, zero‑days, and polymorphic malware.
- Advanced Strategic Threat Intelligence Research: Covers the MITRE ATT&CK framework and NIST 800‑53 controls to map and mitigate risk.
What Undercode Say:
- Trusted tools can become attack vectors. No vulnerability was exploited; the attackers simply used legitimate features. This shifts the focus to user behavior and configuration management.
- Blockchain‑based C2 is a game changer. By using immutable public ledgers for C2 resolution, PHANTOMPULSE creates a resilient, takedown‑resistant infrastructure. Defenders must monitor for blockchain API traffic.
- Social engineering remains the most effective initial access vector. The REF6598 campaign’s success hinged on building credibility through LinkedIn and Telegram. Security awareness training must evolve to cover these multi‑platform, multi‑persona schemes.
Prediction:
The Obsidian‑based attack will likely inspire copycat campaigns targeting other productivity tools with plugin ecosystems (e.g., VS Code, Notion, Slack). We can expect to see more malware using blockchain and decentralized storage for C2, making traditional domain‑based blocking obsolete. Organizations will need to adopt zero‑trust principles, continuous behavioral monitoring, and proactive threat hunting to keep pace. The line between “feature” and “vulnerability” will continue to blur, forcing security teams to rethink application whitelisting and plugin management policies.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mayura Kathiresh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
