TGTGInsighttelegram intelligenceLIVE / telegram public index
TGINSIGHT POST
Post #8813
@thehackernews
The Hacker News
Post content
Post content
⚠️ Attackers are using Obsidian’s plugin system to run malware. Targets move LinkedIn → Telegram → shared vault, where code runs only after enabling plugins. The payload deploys PHANTOMPULSE with Ethereum-based C2. 🔗 Read how → https://thehackernews.com/2026/04/obsidian-plugin-abuse-delivers.html