I think the really big takeaway from this is the abuse of a legitimate tool's plugin capability to execute💀scripts. Many hours of work over the weekend by @soolidsnakee@DanielStepanic and @SBousseaden.
We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto.
The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault.
Full analysis: https://t.co/y7sGjClCKc
We uncovered a new Brazilian banking trojan campaign: TCLBANKER.
What makes TCLBANKER notable isn’t just the malware itself, but how it spreads.
The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection.
For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit.
Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign.
Read the full analysis: https://t.co/9z47oaEWdD
Elastic Security Labs warned that attackers are targeting crypto users through Obsidian community plugins that silently install PHANTOMPULSE malware. They lure victims into opening a shared cloud vault in the note-taking app.
"Salary Slips.exe." "Dont Delete.exe." "Important.exe."
These are the filenames BRUSHWORM copies itself as when spreading across USB drives in a targeted attack on a South Asian financial institution.
Elastic Security Labs uncovered two custom components working together: a modular backdoor and a persistent keylogger masquerading as libcurl.dll.
Full analysis: https://t.co/BOSZHsf8kQ
Bravo for releasing this. There's a reason these are successful: they spend a lot of resources to make them so.
Putting this stuff out in the public is how we raise all ships.
‼️ The axios lead maintainer has gone public on how he was socially engineered into installing the malware behind the npm supply chain attack.
We have example images showing exactly how the attack was staged.
One of our researchers built an AI powered supply chain monitoring tool on a Friday afternoon.
The following Monday night it caught the Axios npm compromise before most people knew it existed.
Elastic Security Labs is open sourcing the tool.
Full story by @dez_ here: https://t.co/wjT58qQYNO
We have discovered a massive supply chain compromise in the Axios npm package.
A backdoored maintainer account delivered a cross-platform RAT for Linux, Windows & macOS, targeting the Axios package, which has ~100M weekly downloads and is in the top five most popular Node.js packages.
We filed a GitHub Security Advisory to coordinate the disclosure, ensuring that the maintainers and the npm registry could act swiftly on the compromised versions.
Full analysis: https://t.co/XFHWdjXJT3
ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS.
Our behavioral detections caught it without relying on static indicators.
Full malware analysis dropping soon: https://t.co/RLFNCpS6AG
@IceSolst This is *exactly* what I am feeling. But, after I chatting with folks at [un]prompted, it felt like everyone is ahead of me.
The only person I chatted with that was able to concretely describe implementation details was at Elastic, and had access to OS and AI logs.
We are tracking #clickfix campaign hosted and served by two compromised websites. Lua in-memory script loader and a #RAT that we are naming #MimicRat. A blog post will follow soon on @elasticseclabs.
www.ndibstersoft[.]com
d15mawx0xveem1.cloudfront[.]net
xMRi[.]neTwOrk
All Python spin for the Elastic Container Project is available if anyone wants to kick the tires. Probably going to archive the Bash version at the end of 2025(ish) #elasticcontainerproject
https://t.co/Ci1rwbiKYv
New from the developer of #FINALDRAFT: Meet #NANOREMOTE, a newly-discovered Windows backdoor that leverages the Google Drive API for data theft and payload staging.
Get the full analysis and defense strategies: https://t.co/7bJcjzRyL7