Hackers Exploit Obsidian Plugin to Deploy Cross

Gbhackers •Mayura Kathir • April 14, 2026

Hackers are abusing Obsidian’s Shell Commands plugin and shared cloud vaults to deliver a new cross‑platform malware chain that ends with the PHANTOMPULSE remote access trojan. Attackers pose as a venture capital firm targeting financial and cryptocurrency professionals, first engaging over and then moving conversations to Telegram group chats with multiple fake “partners” to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHANTOMPULSE Malware Campaign Exploits Obsidian for Targeted Attacks A sophisticated social engineering campaign has been uncovered, targeting individuals in the financial and cryptocurrency sectors through the Obsidian note-taking application. The attackers, posing as representatives of a venture capital firm, lure victims into using a compromised cloud vault. Once the vault is accessed, malicious plugins execute a remote access trojan (RAT) named PHANTOMPULSE, which operates on both Windows and macOS systems. This malware employs a decentralized command-and-control mechanism utilizing blockchain technology, making it resilient against takedowns. The campaign has been tracked under the identifier REF6598 and leverages legitimate community plugins to execute malicious code without exploiting software vulnerabilities. Elastic Security Labs detected and blocked the attack at an early stage, but the potential for widespread impact remains significant. The malware's stealth and advanced techniques pose serious risks to targeted sectors. 9 sources 69

Extracted Entities

Hackers Exploit Obsidian Plugin to Deploy Cross

The full story

Extracted Entities

Attack Types (2)

Industries (1)

Malware (1)

Platforms (2)

Tools (1)