Obsidian Note Trojan Targets Crypto Pros: A Sleazy Scam

by

In the theatre of silicon and whisper, a fresh social engineering caper pirouettes upon the stage of Obsidian, the note‑taking apparatus that pretends to mind its own business while slyly winking at our credulities. A malware, as plum and polished as a well-tailored lie, preens itself in the attire of productivity and schemes against those who deal in crypto and finance.

Summary

  • Scammers are using LinkedIn and Telegram to trick crypto professionals into downloading malicious Obsidian plugins that deploy a remote access trojan.
  • Elastic Security Labs discovered that the undocumented PHANTOMPULSE malware uses three different blockchain networks to receive commands and maintain persistence.
  • Security researchers recommend that financial firms implement strict application-level plugin policies to prevent legitimate productivity tools from being exploited.

Elastic Security Labs released a report detailing how attackers employ “elaborate social engineering on LinkedIn and Telegram” to sidestep ordinary security by cunningly nestling malicious code within community‑developed plugins, as if vanity itself could be weaponized.

The campaign targets the denizens of the digital asset realm, savoring the permanent ledger of blockchain transactions. This vulnerability sharpens its claws when wallet compromises swagger into the ledger of 2025, amounting to $713 million in stolen funds, according to Chainalysis data.

The infiltration begins with scammers posing as venture capital raconteurs on LinkedIn to ignite professional chatter. These conversations glide to Telegram, where the attackers discourse about cryptocurrency liquidity solutions to fashion a “plausible business context.”

When trust has become a sturdy habit, targets are invited to access what is described as a company database or dashboard hosted on a shared Obsidian cloud vault.

Decentralized control via blockchain

Opening the vault becomes the initial access vector. The victim is coaxed to enable community plugin synchronization, which triggers the discreet execution of trojanized software.

Although the Windows and macOS routes differ in a few melodramatic cadences, both culminate in the installation of a previously unknown remote access trojan (RAT) named PHANTOMPULSE.

This malware is engineered to grant attackers full mastery over the infected device while maintaining a languid, almost genteel discretion to baffle the eye of detection.

PHANTOMPULSE maintains its tether to the attackers through a decentralized command-and-control (C2) system that wends its way across three blockchain networks.

By using on-chain transaction data tied to specific wallets, the malware can receive instructions without a central server-because, evidently, bureaucracy is a relay race in the cryptographic coliseum.

“Because blockchain transactions are immutable and publicly accessible, the malware can always locate its C2 without relying on centralized infrastructure,” Elastic noted with the severity of a librarian who has just discovered a stolen bookmark.

The use of multiple chains ensures the attack remains resilient even if one blockchain explorer is restricted. This method allows the operators to rotate their infrastructure with the grace of a gymnast changing partners, making it arduous for defenders to sever the thread between malware and source.

Elastic warned that by abusing Obsidian’s intended functionality, the hackers managed to “skirt traditional security controls entirely.”

The firm suggests that organizations operating in high‑risk financial sectors should implement strict application‑level policies for plugins to prevent legitimate productivity tools from being repurposed as entry points for theft.

Read More

2026-04-15 12:08