Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

MITRE Techniques

• [T1566 ] Phishing – Social engineering over LinkedIn and Telegram was used to lure targets into opening the attacker-controlled Obsidian vault and enabling plugin sync (‘The threat actors operate under the guise of a venture capital firm, initiating contact with targets through LinkedIn…the conversation moves to a Telegram group’).
• [T1059 ] Command and Scripting Interpreter – PowerShell and AppleScript were used to bootstrap and execute staged payloads on Windows and macOS (‘suspicious PowerShell execution with Obsidian as the parent process’; ‘the Shell commands plugin’s macOS command executes a Base64-encoded payload through osascript’).
• [T1547 ] Boot or Logon Autostart Execution – macOS persistence was achieved by creating a LaunchAgent plist to run the second-stage dropper at login (‘Creates a persistent LaunchAgent plist at ~/Library/LaunchAgents/com.vfrfeufhtjpwgray.plist configured with KeepAlive and RunAtLoad set to true’).
• [T1055 ] Process Injection – The Windows loader and RAT perform reflective in-memory loading and advanced injection techniques including module stomping to execute payloads without touching disk (‘reflectively loads payloads entirely in memory’ and ‘advanced process injection via module stomping’).
• [T1071 ] Application Layer Protocol – PHANTOMPULSE communicates with C2 over HTTPS using WinHTTP and defined API endpoints for telemetry, tasking, uploads, and results (‘PHANTOMPULSE uses WinHTTP for C2 communication… /v1/telemetry/report POST’).
• [T1548 ] Abuse Elevation Control Mechanism – The malware includes an escalation capability to SYSTEM via COM elevation moniker as a method for privilege escalation (‘Escalate to SYSTEM via COM elevation moniker’).
• [T1056 ] Input Capture (Keylogging) – Keylogging capability and a C2 endpoint for keylog uploads are included in the RAT (‘v1/telemetry/keylog/POSTKeylog data upload’; ‘keylogStart/stop keylogger’).
• [T1113 ] Screen Capture – The RAT can capture and upload screenshots to the C2 (‘screenshotCapture and upload a screenshot’; ‘v1/telemetry/upload/POSTScreenshot/file upload’).
• [T1041 ] Exfiltration Over C2 Channel – Collected data (screenshots, keylogs, command results) is uploaded back to operator-controlled endpoints over the C2 channel (‘v1/telemetry/upload/POSTScreenshot/file upload’ and ‘/v1/telemetry/result POST Command result delivery’).
• [T1199 ] Trusted Relationship – The adversary abused Obsidian’s legitimate plugin ecosystem and a signed Obsidian client to execute attacker-controlled commands via user-enabled plugin sync (‘abuses Obsidian’s legitimate community plugin ecosystem, specifically the Shell Commands and Hider plugins’).