Elastic Security LabsPublished
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
By Salim Bitam
Excerpt
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware.
Preamble
Elastic Security Labs has identified a novel social engineering campaign that abuses the popular note-taking application, Obsidian, as an initial access vector. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram. The threat…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Auditing the auditor: Unmasking Apex AcceleratorElastic Security Labs · Published 12 Oct
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- Shedding light on the ABYSSWORKER driverElastic Security Labs · Published 20 Mar 2025
- TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chainsElastic Security Labs · Published 16 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
