I just came across an interesting case from Elastic Security — it turns out cybercriminals found a pretty clever way to spread malware through Obsidian. Here's how it worked.

It all started with the Shell Commands plugin in a popular note-taking app. The attackers compromised the storage and used it as a channel to deploy the PHANTOMPULSE trojan. At first glance, it might seem like a vulnerability in Obsidian itself, but no — Elastic clarified that there were no holes in the app.

The most interesting part is the technical aspect — this trojan used Ethereum transaction data for communication and control. Can you imagine? Instead of traditional communication channels, the malware hid commands directly in the blockchain. This is a pretty smart scheme because tracking such communication is much more difficult.

Overall, this case shows how cybercriminals are becoming increasingly inventive. The trojan spread not through a vulnerability in the code but via social engineering and storage compromise. For the crypto community, this is especially relevant — using blockchain for covert malware communication is a new level. If you work with Obsidian and sync notes through the cloud, you should be more careful about which plugins you install.