PHANTOMPULSE is a sophisticated attack campaign (REF6598) first observed on February 12, 2026, targeting financial services and cryptocurrency organizations worldwide through weaponized Obsidian note-taking application exploitation. This PHANTOMPULSE attack begins with highly orchestrated social engineering on LinkedIn, where threat actors impersonate venture capital representatives to build trust with targets in the financial services and cryptocurrency sectors. The PHANTOMPULSE campaign moves conversations to Telegram groups populated with seemingly credible partners to reinforce legitimacy before persuading victims to adopt Obsidian as an internal management platform. The critical PHANTOMPULSE compromise occurs when victims are socially engineered to manually enable the "community plugins" sync feature in Obsidian, which is disabled by default. This action allows weaponized plugin configurations to propagate and initiate a multi-stage PHANTOMPULSE infection chain. The PHANTOMPULSE malware deploys the PHANTOMPULL loader, which ultimately executes the PHANTOMPULSE RAT (Remote Access Trojan). PHANTOMPULSE malware blends advanced evasion techniques with an unconventional blockchain-based command-and-control mechanism, leveraging public Ethereum blockchain transactions to dynamically resolve attacker infrastructure. PHANTOMPULSE capabilities range from in-memory execution and privilege escalation to comprehensive system surveillance, keylogging, and data exfiltration. The PHANTOMPULSE campaign demonstrates a refined fusion of social engineering sophistication and technical innovation, transforming a legitimate note-taking tool into a covert gateway for persistent system compromise across both Windows and macOS platforms.
LinkedIn to Telegram: Building Trust Through Social Engineering
The PHANTOMPULSE social engineering campaign has been observed abusing Obsidian note-taking application as a covert entry point for malware deployment, blending business pretexting with plugin-based exploitation to deliver a multi-stage PHANTOMPULSE malware chain. The PHANTOMPULSE attack is meticulously staged, beginning on LinkedIn where PHANTOMPULSE threat actors impersonate venture capital representatives to build trust with targets in financial services and cryptocurrency industries. Once initial rapport is established through LinkedIn conversations, the PHANTOMPULSE attackers move the conversation to a Telegram group populated with seemingly credible financial partners, reinforcing the social engineering legitimacy. Framed around financial services operations and cryptocurrency liquidity management, the PHANTOMPULSE narrative persuades the target to adopt Obsidian as the firm's internal management platform, granting access to an attacker-controlled Obsidian vault. The critical PHANTOMPULSE turning point comes when the victim is convinced to manually enable the "community plugins" sync feature in Obsidian, which is disabled by default for security reasons, allowing the weaponized PHANTOMPULSE plugin configuration to propagate and initiate malware execution.
Multi-Stage Payload Delivery: PHANTOMPULL Loader to PHANTOMPULSE RAT
Once the Obsidian trust boundary is crossed through social engineering, the PHANTOMPULSE compromise unfolds rapidly through automated malware deployment. The synced Obsidian configuration triggers the Shell Commands plugin, which executes Base64-encoded PowerShell commands on vault access. The initial PHANTOMPULSE stage retrieves a second-stage script from a hardcoded IP address, which subsequently downloads a payload named syncobs.exe acting as the PHANTOMPULL loader. This PHANTOMPULL loader decrypts an embedded PHANTOMPULSE payload using AES-256-CBC encryption and executes it directly in memory via reflective loading techniques, leveraging timer queue callbacks to evade sandbox detection systems. The PHANTOMPULL loader then fetches the final PHANTOMPULSE payload over HTTPS, decrypts it using a rotating XOR key encryption scheme, and executes the PHANTOMPULSE malware while employing multiple anti-analysis techniques including runtime API resolution and decoy logic to avoid detection by security tools.
Blockchain C2 Innovation: Ethereum-Based Command Infrastructure
PHANTOMPULSE operates as a sophisticated, AI-assisted Windows RAT (Remote Access Trojan), introducing an unconventional command-and-control mechanism that sets this malware apart from traditional threat campaigns. Instead of relying solely on traditional C2 infrastructure that can be easily blocked or taken down, PHANTOMPULSE leverages public Ethereum blockchain data as a dead-drop resolver for command-and-control communications. By querying Ethereum transaction data tied to a hardcoded wallet address, PHANTOMPULSE extracts and decrypts C2 instructions embedded within blockchain transactions, making the command infrastructure highly resilient to takedown efforts. However, security researchers have identified a notable flaw in the PHANTOMPULSE blockchain C2 implementation: the lack of sender verification means any actor aware of the wallet address and encryption key could potentially hijack the PHANTOMPULSE communication flow. Beyond the blockchain mechanism, PHANTOMPULSE malware communicates via WinHTTP with multiple endpoints to handle telemetry collection, command execution, data exfiltration, and keylogging operations. PHANTOMPULSE capabilities extend to process injection, privilege escalation to SYSTEM level, persistence manipulation through scheduled tasks, and comprehensive system control enabling full remote access.
macOS Variant: Cross-Platform PHANTOMPULSE Deployment
On macOS systems, the PHANTOMPULSE attack follows a parallel yet platform-specific execution path tailored to Apple operating system environments. The malicious Obsidian plugin executes a Base64-encoded PHANTOMPULSE payload via osascript, establishing persistence through a LaunchAgent configured to run continuously across system reboots. The PHANTOMPULSE macOS payload is heavily obfuscated, using fragmented strings and character-based encoding techniques to hinder malware analysis and evade detection. For command-and-control communications, PHANTOMPULSE cycles through predefined domains and even scrapes a public Telegram channel as a fallback mechanism, enabling dynamic infrastructure rotation to maintain persistent access. A secondary PHANTOMPULSE payload is then fetched and executed directly in memory without touching disk. Additionally, the PHANTOMPULSE attackers deploy the Hider plugin to suppress key interface elements within the Obsidian application, effectively masking the malicious PHANTOMPULSE activity from the victim. In the observed PHANTOMPULSE case, the intrusion was intercepted early during the infection chain, preventing the final PHANTOMPULSE payload from fully executing and establishing complete system compromise.
Monitor Obsidian Child Process Execution for PHANTOMPULSE Indicators
Deploy behavioral detection rules to alert security operations on anomalous child process creation spawned by the Obsidian application binary. Specifically monitor for PowerShell, cmd.exe, bash, or osascript processes launched by Obsidian, as this represents the primary behavioral indicator of REF6598 PHANTOMPULSE activity. This detection rule should trigger immediate investigation when Obsidian spawns command interpreters, as legitimate Obsidian usage does not require executing system commands.
Restrict Community Plugin Sync in Obsidian to Prevent PHANTOMPULSE
Enforce organizational security policies that explicitly prohibit users from enabling community plugin synchronization in Obsidian note-taking application, particularly when connecting to Obsidian vaults provided by external parties or unknown sources. Educate users through security awareness training that the "Installed community plugins" sync option should remain disabled by default, as enabling this feature is the critical step in PHANTOMPULSE infection. Consider implementing technical controls through application management solutions to prevent users from enabling this feature.
Hunt for Obsidian Shell Commands Plugin Artifacts
Proactively search endpoints for the presence of obsidian-shellcommands directories and associated data.json configuration files located under .obsidian/plugins/ paths in user directories. These artifacts indicate potential weaponized Obsidian vault configurations used in PHANTOMPULSE attacks. Security teams should conduct regular threat hunting exercises to identify these PHANTOMPULSE indicators across the environment before malware execution occurs.
Strengthen Social Engineering Awareness for Finance and Crypto Teams
Conduct targeted security awareness training specifically for personnel in financial services and cryptocurrency roles, emphasizing the social engineering risks of engaging with unknown entities on LinkedIn and Telegram platforms who request installation of software, sharing of vault credentials, or enabling of application features. Train employees to recognize PHANTOMPULSE social engineering tactics including impersonation of venture capital representatives, pressure to adopt new collaboration tools, and requests to modify security settings. Implement verification procedures for any requests to install new software or enable features that were previously disabled.
Inspect LaunchAgent Persistence on macOS for PHANTOMPULSE
Audit macOS endpoints for suspicious LaunchAgent plist files located under ~/Library/LaunchAgents/ directories, particularly those with randomized naming patterns and KeepAlive/RunAtLoad configurations that execute shell commands piped to osascript. These LaunchAgent configurations represent PHANTOMPULSE persistence mechanisms on Apple systems. Regular audits should identify unauthorized LaunchAgents before PHANTOMPULSE malware can establish persistent access.
Enforce Application Allowlisting and Script Controls
Implement application control policies that restrict PowerShell execution to approved scripts digitally signed by trusted publishers and prevent unsigned AppleScript/osascript payloads from executing on endpoints. These controls reduce the attack surface for both the Windows and macOS PHANTOMPULSE execution chains by preventing unauthorized scripting interpreters from running malicious code. Consider implementing constrained language mode for PowerShell and restricting osascript execution to approved applications only.
PHANTOMPULSE Malware File Hashes (SHA-256)
PHANTOMPULSE Command-and-Control Infrastructure (IPv4)
PHANTOMPULSE Command-and-Control Domains
PHANTOMPULSE Command-and-Control URLs
PHANTOMPULSE Ethereum Blockchain Wallets
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Discovery
Collection
Command and Control
