Andrew Pease

Elastic Security Labs Technical Lead. Lawful Neutral. Threat Hunting with the Elastic Stack author. Retired CW4.

[Andrew Pease @andythevariable]

I think the really big takeaway from this is the abuse of a legitimate tool's plugin capability to execute💀scripts. Many hours of work over the weekend by @soolidsnakee @DanielStepanic and @SBousseaden.

[Elastic Security Labs @elasticseclabs]

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto.

The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault.

Full analysis: https://t.co/y7sGjClCKc

[Andrew Pease @andythevariable]

The attempts at environmental anti-tamper techniques to encrypt the payload were clever…just not enough. #tclbanker #ref3076

[Elastic Security Labs @elasticseclabs]

We uncovered a new Brazilian banking trojan campaign: TCLBANKER.

What makes TCLBANKER notable isn’t just the malware itself, but how it spreads.

The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection.

For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit.

Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign.

Read the full analysis: https://t.co/9z47oaEWdD

[🄱 @lvc1ferrr]

Elastic Security Labs warned that attackers are targeting crypto users through Obsidian community plugins that silently install PHANTOMPULSE malware. They lure victims into opening a shared cloud vault in the note-taking app.

[Seth @bluish_red_]

points to the same Phantom panel, so convicted #PHANTOMPULSE !

h/t @soolidsnakee

[Seth @bluish_red_]

LET'S GO!

That first query caught another TX today. New domain! Presumably #PHANTOMPULSE.

`https://gfsdjjg33jfk[.]com`

https://t.co/vzkTFwcyNY

[Andrew Pease @andythevariable]

Tremendous work @soolidsnakee!

[Elastic Security Labs @elasticseclabs]

"Salary Slips.exe." "Dont Delete.exe." "Important.exe."

These are the filenames BRUSHWORM copies itself as when spreading across USB drives in a targeted attack on a South Asian financial institution.

Elastic Security Labs uncovered two custom components working together: a modular backdoor and a persistent keylogger masquerading as libcurl.dll.

Full analysis: https://t.co/BOSZHsf8kQ

[Andrew Pease @andythevariable]

Bravo for releasing this. There's a reason these are successful: they spend a lot of resources to make them so.

Putting this stuff out in the public is how we raise all ships.

[International Cyber Digest @IntCyberDigest]

‼️ The axios lead maintainer has gone public on how he was socially engineered into installing the malware behind the npm supply chain attack.

We have example images showing exactly how the attack was staged.

[Andrew Pease @andythevariable]

Seeing this tool in action is fantastic, but don’t sleep on the fact that it was also released for your environment https://t.co/pWPr2Mi3T9

[Elastic Security Labs @elasticseclabs]

One of our researchers built an AI powered supply chain monitoring tool on a Friday afternoon.

The following Monday night it caught the Axios npm compromise before most people knew it existed.

Elastic Security Labs is open sourcing the tool.

Full story by @dez_ here: https://t.co/wjT58qQYNO

[Samir @SBousseaden]

New blog post - prioritizing alerts triage with higher-order detection rules

https://t.co/3E11NJCdxC

[Joe Desimone @dez_]

Analysis of the macho malware used in the Axios supply chain compromise
https://t.co/d0OouEFtUL

[Joe Desimone @dez_]

Now let's talk attribution. @DefSecSentinel quickly pointed to DPRK 🇰🇵. Remarkable similarities to WAVESHAPER / UNC1069

[Jake @JakeKing]

Not to mention:

@SBousseaden
@RFGroenewoud
@andythevariable

Go follow them too, they do cool shit, constantly.

[Jake @JakeKing]

If you've not seen the work that @dez_, @DefSecSentinel and the whole @elasticseclabs team have published on Axios, you're missing out.

[Andrew Pease @andythevariable]

Speaking of finger-pointing...we're lookin' at you #UNC1069

[Elastic Security Labs @elasticseclabs]

We have discovered a massive supply chain compromise in the Axios npm package.

A backdoored maintainer account delivered a cross-platform RAT for Linux, Windows & macOS, targeting the Axios package, which has ~100M weekly downloads and is in the top five most popular Node.js packages.

We filed a GitHub Security Advisory to coordinate the disclosure, ensuring that the maintainers and the npm registry could act swiftly on the compromised versions.

Full analysis: https://t.co/XFHWdjXJT3

[Andrew Pease @andythevariable]

Big work by the whole crew on this. Detections first, then analysis and finger-pointing.

[Elastic Security Labs @elasticseclabs]

ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS.

Our behavioral detections caught it without relying on static indicators.

Full malware analysis dropping soon: https://t.co/RLFNCpS6AG

[Olivia Gallucci ✨ @OliviaGalluccii]

@IceSolst This is *exactly* what I am feeling. But, after I chatting with folks at [un]prompted, it felt like everyone is ahead of me.

The only person I chatted with that was able to concretely describe implementation details was at Elastic, and had access to OS and AI logs.

[SolidSnake @soolidsnakee]

We are tracking #clickfix campaign hosted and served by two compromised websites. Lua in-memory script loader and a #RAT that we are naming #MimicRat. A blog post will follow soon on @elasticseclabs.

www.ndibstersoft[.]com
d15mawx0xveem1.cloudfront[.]net
xMRi[.]neTwOrk

[Andrew Pease @andythevariable]

@_devonkerr_ @0xTriboulet

[Andrew Pease @andythevariable]

All Python spin for the Elastic Container Project is available if anyone wants to kick the tires. Probably going to archive the Bash version at the end of 2025(ish) #elasticcontainerproject

https://t.co/Ci1rwbiKYv

[Andrew Pease @andythevariable]

@DanielStepanic and @elasticseclabs are keeping on top of #REF7707 and their new RAT - #NANOREMOTE

[Elastic Security Labs @elasticseclabs]

New from the developer of #FINALDRAFT: Meet #NANOREMOTE, a newly-discovered Windows backdoor that leverages the Google Drive API for data theft and payload staging.

Get the full analysis and defense strategies: https://t.co/7bJcjzRyL7