Gate News message, April 15 — Elastic Security Labs disclosed that threat actors impersonated venture capital firms to lure targets via LinkedIn and Telegram into opening malicious Obsidian note vaults. The attack leveraged Obsidian’s Shell Commands plugin to execute malicious payloads when victims opened the vault, requiring no vulnerability exploitation.
PHANTOMPULSE, a previously undocumented Windows remote access trojan (RAT), was discovered in the attack. It uses blockchain C2 communication via Ethereum transaction data. The macOS payload employed an obfuscated AppleScript dropper with a Telegram channel as a backup C2.
Elastic Defend detected and blocked the attack before PHANTOMPULSE execution.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Criticized for freezing USDC too slowly! Circle CEO: We will definitely wait for the court’s order before freezing—refusing to freeze privately/by ourselves without authorization
Circle CEO Jeremy Allaire said the company will not proactively freeze wallet addresses unless it receives a court order or a request from law enforcement. Even amid hacker money-laundering disputes and community backlash, Circle still insists on operating in accordance with the rule of law.
Jeremy Allaire sets Circle’s law-enforcement bottom line
-----------------------------
As the global cryptocurrency market roils, Circle’s CEO Jeremy Allaire, the stablecoin issuer, delivered a clear stance on the most sensitive issue in the market at a press conference in Seoul, South Korea. He pointed out that although Circle has the technical means to freeze specific wallet addresses, unless it receives a court order or a formal instruction from law-enforcement authorities, the company will not take such action on its own.
CryptoCity10m ago
Attacker Exploiting Bridged Polkadot Vulnerability Transfers $269K to Tornado Cash
On April 15, Arkham reported that the attacker who exploited a Bridged Polkadot vulnerability transferred around $269,000 in stolen funds to Tornado Cash, complicating asset tracking.
GateNews38m ago
Bitcoin Developers Propose BIP 361 to Protect Against Quantum Computing Threats
Bitcoin developers have proposed BIP 361 to safeguard the network against quantum computer risks by freezing vulnerable addresses. The proposal includes a phased plan to transition users to quantum-safe wallets, but it has sparked debate on user control and security.
GateNews47m ago
Zerion Hot Wallet Loses $100K in AI-Driven Social Engineering Attack by North Korea-Linked Hackers
Zerion confirmed a recent AI-driven social engineering attack by North Korean hackers, resulting in a $100,000 loss from corporate hot wallets. User funds remain safe, and the company has taken precautionary measures. This follows another significant attack on Drift Protocol.
GateNews2h ago
CoW Swap Pauses Protocol After DNS Hijacking Drains at Least $1M in User Funds
CoW Swap suspended its protocol after DNS hijacking redirected users to a fraudulent site, resulting in over $1 million in crypto theft. The incident led to precautionary actions and user warnings, while security measures were implemented.
GateNews4h ago
Lattice Announces Shutdown: Redstone Will Close on May 16, Users Must Withdraw by the Deadline
Gaming infrastructure developer Lattice announced it will shut down on May 15 and reminded users to withdraw their funds. After the shutdown, contract funds cannot be withdrawn through L1 contracts; only funds in personal wallets can be recovered. Over the past five years, Lattice has failed to realize its business model and ultimately decided to close, but its MUD framework and DUST game will continue to run.
MarketWhisper5h ago
