New PHANTOMPULSE Malware Targets Crypto Users via Obsidian App
Security researchers have identified a sophisticated social engineering campaign leveraging the Obsidian note-taking app to deploy a novel remote access trojan (RAT) named PHANTOMPULSE. Attackers pose as venture capital representatives on LinkedIn, moving conversations to Telegram to build trust before directing victims to enable community plugin synchronization in Obsidian.
This action silently executes malicious code, granting attackers control. PHANTOMPULSE utilizes decentralized, blockchain-based command-and-control (C2) mechanisms across three networks for stealth and resilience, making it infrastructure-agnostic. This highlights rising threats in DeFi, with $713 million stolen from crypto wallets in 2025 alone. Experts advise strict app-level plugin policies and extreme caution with unsolicited opportunities requiring third-party software installation.


Cryptovka
New PHANTOMPULSE Malware Targets Crypto Users via Obsidian App
Security researchers have identified a sophisticated social engineering campaign targeting professionals in the cryptocurrency and financial sector...


















