New Obsidian malware targets crypto finance professionals

TLDR

A new PHANTOMPULSE malware campaign is abusing the Obsidian note?taking app to compromise devices used by crypto and finance professionals.

1. Attackers pose as crypto VC contacts on LinkedIn and Telegram, then trick targets into syncing malicious Obsidian plugins that install the PHANTOMPULSE remote access trojan.
2. PHANTOMPULSE uses on?chain data across three blockchains for its command system, making it resilient and well suited to stealing wallet keys and financial data from high?value crypto users.
3. The best defenses are strict plugin policies, hardened device hygiene and separating trading keys from general?purpose work devices, especially for anyone handling institutional or large personal crypto flows.

Deep Dive

1. How The Obsidian Attack Works

Security firm Elastic detailed a campaign that weaponizes Obsidians community plugins to deploy a stealthy RAT called PHANTOMPULSE against crypto and finance professionals, confirmed in multiple reports including this analysis.

The sequence is consistent across sources: attackers approach via LinkedIn as venture capital or trading counterparties, move conversations to Telegram, then invite victims to collaborate in an Obsidian company database hosted in a shared cloud vault.

The compromise happens when the victim enables community plugin sync for that vault, which silently installs a trojanized plugin that runs PHANTOMPULSE on Windows or macOS with full device control while trying to avoid detection.

2. Why Crypto Pros Are Prime Targets

PHANTOMPULSE maintains command and control by reading attacker instructions encoded in transactions across at least three different blockchains, so there is no single server to take down and the malware can always find its operators.

The campaign specifically focuses on digital asset professionals, taking advantage of the fact that compromised wallets led to about $713 million in losses in 2025, according to Chainalysis figures cited in the same Obsidian malware report.

Because blockchain transactions are irreversible, any theft enabled by a RAT on a traders laptop or analysts workstation is final, which makes those users more attractive than typical corporate employees.

3. Defenses For Individuals And Firms

Elastic and industry reports recommend treating productivity apps like Obsidian as potential attack surfaces, enforcing policies that restrict or ban unvetted third?party plugins on corporate machines.

Teams should verify new investor or counterparty contacts through out?of?band channels, be skeptical of requests to install specific tools or sync shared vaults, and avoid using the same device for both general work and high?sensitivity wallet operations.

For individuals, keeping long?term holdings on hardware wallets, never entering seed phrases into apps, and regularly reviewing device security and installed plugins can materially reduce the blast radius if a work machine is compromised.

Conclusion

This Obsidian and PHANTOMPULSE campaign shows how attackers are combining tailored social engineering with legitimate app ecosystems and blockchain?based command channels to go after crypto money at the human layer. For anyone in digital assets, tightening plugin governance, separating critical keys from day?to?day devices and treating unsolicited VC outreach with extreme caution are now core parts of basic operational security.