Elastic Security Labs uncovered a new social engineering campaign that abuses the Obsidian note-taking platform and its community plugin ecosystem to deliver PhantomPulse, a previously undocumented RAT targeting both Windows and macOS systems. The operation appears aimed at individuals in the financial and cryptocurrency space, with attackers using and Telegram to distribute a compromised Obsidian vault as the initial lure. On Windows, the infection chain relies on PowerShell, a custom in-memory loader known as PhantomPull, and reflective loading techniques. On macOS, the attackers use AppleScript along with a Telegram-based dead-drop command-and-control mechanism. The campaign also incorporates blockchain-based C2 discovery through Ethereum transaction data.
Researchers reproduced the attack by building a weaponized Obsidian vault that used the Shell Commands and Hider plugins to trigger malicious execution. During analysis, they observed PowerShell scripts downloading a loader named syncobs.exe from 195.3.222.251 , which then retrieved an encrypted payload and loaded it reflectively in memory. The loader created a mutex, communicated with a control panel hosted at panel.fefea22134.net , and supported fallback infrastructure derived from blockchain data. On macOS, the malware established persistence through a LaunchAgent plist and downloaded a secondary AppleScript payload from a hard-coded domain and a Telegram channel. Investigators recovered key artifacts from JSON configuration files and in-memory resources tied to both infection paths.
Organizations should prevent Obsidian from spawning unauthorized child processes, apply strict controls over community plugin usage, and monitor for PowerShell activity where Obsidian appears as the parent process. Network defenses should block outbound traffic to 195.3.222.251 and the domains panel.fefea22134.net , 0x666.info , and known Telegram dead-drop locations associated with the campaign. Security teams should also look for signs of reflective loading, timer-queue callback abuse, and the specific mutex value used by the malware loader.
If suspicious child processes are detected from Obsidian, isolate the affected host immediately and collect the .obsidian directory for forensic review of malicious plugin files and vault content. Hunt for the mutex hVNBUORXNiFLhYYh , then scan endpoints for traces of the PHANTOMPULL loader and PHANTOMPULSE RAT binaries. Block the identified command-and-control infrastructure, revoke any compromised Obsidian-related credentials, and perform a broader review for credential theft exposure involving financial and cryptocurrency accounts.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands:
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
