← EasyTool.me

Obsidian Plugin Abused to Deploy PhantomPulse RAT — Security Guide 2026

Published: 2026-05-11 Reading: 10 min Security / Supply Chain Attack

Event Overview — REF6598 Campaign

In April 2026, Elastic Security Labs disclosed a novel social engineering campaign tracked as REF6598 that abuses Obsidian, the popular cross-platform note-taking application, as an initial access vector to deliver a previously undocumented Windows remote access trojan called PHANTOMPULSE.

This campaign specifically targets individuals in the financial and cryptocurrency sectors. Rather than exploiting a software vulnerability, the attackers abused Obsidian's legitimate community plugin ecosystem — specifically the Shell Commands and Hider plugins — to silently execute malicious code when a victim opens a shared cloud vault. The attack chain includes an AI-assisted Windows backdoor that uses the Ethereum blockchain for command-and-control (C2) resolution.

The intrusion was detected and blocked early by Elastic Defend, but the technique is significant because it bypasses traditional security controls entirely by relying on the application's intended functionality. After Elastic's disclosure, the story hit the Hacker News front page, sparking widespread discussion about supply chain risks in the note-taking app ecosystem.

Attack Chain: How It Works

The REF6598 attack chain is cleverly designed and consists of multiple stages, with dedicated paths for both Windows and macOS:

Stage 0: Vault Poisoning

The attacker creates a malicious Obsidian vault hosted in cloud storage. Inside the vault's .obsidian/plugins/ directory, they install two community plugins:

The data.json configuration file contains PowerShell commands set to execute on vault open.

Stage 1: PowerShell Execution

When the victim opens the vault, the Shell Commands plugin executes its pre-configured PowerShell commands via Invoke-Expression with Base64-encoded payloads. These commands:

  1. Download script1.ps1 from a hardcoded IP address (195.3.222[.]251)
  2. Execute the script with suppressed windows and bypassed execution policy

Stage 2: Loader Download & Operator Notification

The downloaded script uses BitsTransfer to fetch the next-stage binary (syncobs.exe) and reports progress back to the C2 with status codes:

The tag parameter #OBSIDIAN identifies the infection vector, suggesting the operators may be running multiple concurrent campaigns using different lures.

Stage 3: PHANTOMPULL Loader

The downloaded syncobs.exe is a custom in-memory loader called PHANTOMPULL. It:

This loader then connects to panel.fefea22134[.]net over HTTPS to download and decrypt the final PHANTOMPULSE payload.

Social Engineering Tactic: Fake Venture Capital Firm

The social engineering component is the most sophisticated part of this campaign. Attackers:

The critical social engineering step: the victim must manually enable "Installed community plugins" sync in Obsidian settings. By default, this is disabled and cannot be turned on remotely. The attacker must convince the target to enable it, at which point the malicious plugin configuration syncs down and executes.

PhantomPulse RAT: AI-Generated Backdoor with Blockchain C2

PHANTOMPULSE is a full-featured Windows remote access trojan that Elastic Security Labs describes as "heavily AI-generated." Its standout features include:

Ethereum Blockchain C2 Resolution

Instead of a hardcoded C2 server address, PHANTOMPULSE resolves its command-and-control endpoint by:

This technique makes domain-based blocking insufficient — the C2 address changes with every new Ethereum transaction, providing attackers with nearly instant infrastructure rotation.

Capabilities

Once active, PHANTOMPULSE supports comprehensive remote access:

Elastic Security Labs noted they identified a weakness in the C2 mechanism that allows security responders to take over the implants — a critical detail for defensive teams.

Cross-Platform Targeting: Windows & macOS

Attackers didn't stop at Windows. The macOS execution path uses:

This dual-platform approach demonstrates the attackers' investment in making the campaign effective regardless of the target's operating system.

How Obsidian Users Can Protect Themselves

The REF6598 campaign highlights a critical lesson: even legitimate plugins in trusted applications can be weaponized. Here's how to stay safe:

1. Verify Plugin Sources Before Installing

2. Never Enable Community Plugin Sync for Untrusted Vaults

3. Audit Your Shell Commands Plugin Configuration

4. Use Endpoint Detection and Response (EDR)

5. Practice Good Security Hygiene

6. For Organizations

Summary

The REF6598 campaign represents a new class of supply chain attack that abuses legitimate application features rather than software vulnerabilities. By weaponizing Obsidian's community plugin ecosystem, attackers can execute arbitrary code through a signed, trusted Electron application — making traditional signature-based detection largely ineffective.

Key takeaways:

Source: Elastic Security Labs — Phantom in the Vault

Additional coverage: The Hacker News — Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT