Elastic Security Labs disclosed on April 15 a social engineering campaign targeting workers in the financial and cryptocurrency sectors. The attackers posed as venture capital firms on LinkedIn and Telegram and lured targets into opening a malicious Obsidian vault. According to the report, the campaign abused Obsidian’s Shell Commands plugin to execute payloads without exploiting a software vulnerability. Elastic Security Labs said the operation deployed PHANTOMPULSE, a previously undocumented Windows remote access trojan, and that the malware used Ethereum transaction data as a blockchain-based command-and-control channel. The report described the malware as stealthy and said the campaign specifically targeted cryptocurrency and finance professionals.