Fake VC scam weaponizes Obsidian plugins to deploy PHANTOMPULSE RAT with on-chain C2

Elastic Security Labs uncovered a social engineering campaign where attackers pose as VCs on LinkedIn, move to Telegram pitching "crypto liquidity solutions," then trick targets into syncing a trojanized Obsidian vault. The malicious Shell Commands plugin drops PHANTOMPULSE, a cross-platform RAT (Windows and macOS) that resolves its C2 endpoints via Ethereum, Base, and Optimism Blockscout APIs — encoding server URLs in on-chain transaction data tied to a hardcoded wallet. Clever design flaw: any third party can hijack the C2 by submitting competing transactions to the same wallet address. Worth watching for anyone in crypto who gets cold LinkedIn DMs from "investors" wanting to share their company's Obsidian workspace.

TLDR by @Benthic

More coverage

• Obsidian Plugin Abuse Delivered PhantomPulse RAT to Finance ... (mallory.ai)
• Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted ... (thehackernews.com)
• PhantomPulse RAT via Malicious Obsidian Vaults - SOC Prime (socprime.com)
• Key takeaways: (x.com)
• Obsidian Plugin Scam Targets Crypto Users with Malware (cryptorank.io)

Explore the topic

• Scam
• Onchain