Hackers Weaponize Obsidian Shell Commands Plugin to Launch Cross

Cybersecuritynews •Tushar Subhra Dutta • April 14, 2026

Threat actors have found a clever way to abuse a trusted productivity tool to deliver malware. By weaponizing Obsidian’s Shell Commands community plugin, attackers are quietly executing malicious code on victims’ machines — all without exploiting a single software vulnerability. The campaign, tracked as REF6598, targets individuals working in the financial and cryptocurrency sectors. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHANTOMPULSE Malware Campaign Exploits Obsidian for Targeted Attacks A sophisticated social engineering campaign has been uncovered, targeting individuals in the financial and cryptocurrency sectors through the Obsidian note-taking application. The attackers, posing as representatives of a venture capital firm, lure victims into using a compromised cloud vault. Once the vault is accessed, malicious plugins execute a remote access trojan (RAT) named PHANTOMPULSE, which operates on both Windows and macOS systems. This malware employs a decentralized command-and-control mechanism utilizing blockchain technology, making it resilient against takedowns. The campaign has been tracked under the identifier REF6598 and leverages legitimate community plugins to execute malicious code without exploiting software vulnerabilities. Elastic Security Labs detected and blocked the attack at an early stage, but the potential for widespread impact remains significant. The malware's stealth and advanced techniques pose serious risks to targeted sectors. 9 sources 69

Extracted Entities

Hackers Weaponize Obsidian Shell Commands Plugin to Launch Cross

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)