Hackers Weaponize Obsidian Shell Commands Plugin to Launch Cross-Platform Malware Attacks

Summary: Hackers Exploit Obsidian Shell Commands Plugin for Cross-Platform Malware Attacks

Hackers have exploited the Obsidian Shell Commands plugin to launch cross-platform malware attacks targeting both Windows and macOS systems. The attack leverages a trojanized version of the plugin, which triggers execution upon opening an attacker-controlled vault and enabling community plugin sync.

Attack Mechanism:

1. Initial Trigger: When the victim opens the attacker-controlled vault and enables community plugin sync, the trojanized Shell Commands plugin's data.json configuration file downloads silently.
2. Windows Execution:
   • The plugin fires two Invoke-Expression calls with Base64-encoded strings to retrieve a PowerShell script from a staging server at 195.3.222[.]251.
   • This script uses BitsTransfer to download the 64-bit executable syncobs.exe, which decrypts an AES-encrypted payload and loads it entirely into memory.
3. Final Payload (PHANTOMPULSE):
   • PHANTOMPULSE, a full-featured backdoor, employs a novel C2 resolution technique using public Ethereum blockchain data to query Blockscout APIs for encrypted C2 URLs

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.