We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users. New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration. KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction. The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on. Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP. Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign. The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

Elastic Security Labs is tracking Golden Gh0st RAT targeting Western companies, expanding beyond its previously documented targeting of financial organizations in the Asia-Pacific region. Same TTPs as @ExpelSecurity CylindricalCanine research post: go.es.io/3TEZ0G6 The initial payload was delivered as a fake screenshot with a .pif extension, signed with a revoked certificate and hosted on myphotos[.]s[.]gy. Follow-on payloads were staged in a public Google Cloud Storage bucket at storage[.]googleapis[.]com/nikeupdat/. Multiple stages, and every one is either validly code-signed or never exists on disk as an executable. Abused code-signing certificates, all valid at time of use. Two are EV, same CA, both dated 2026-07, issued to two different "Private Organization" subjects: - 杭州思维宇宙科技有限公司 (Hangzhou Siwei Yuzhou Technology), thumbprint: 14E0FCA3F0F656D1AF6EA66E1B2B7C6B4ACD8E2D - Dongguan Jieshan Technology Co., Ltd, thumbprint: C29C3C494A348EA879ABFF50DD56B85E9CB6366A IOCs: api[.]probref[.]com:5188 (C2) storage[.]googleapis[.]com/nikeupdat/ myphotos[.]s[.]gy 5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f b6cb6d5de2c62aa1351b1b240dc223c3d6fa95083cf43b2866d84a8a6c4d0446

When the attacker is an autonomous agent, outcome detections beat process tree trust. OpenAI's eval models escaped a research sandbox during ExploitGym testing. The agent exploited a package-registry zero-day, reached the open internet, and hit Hugging Face's dataset processing pipeline. Hugging Face reconstructed 17,000+ events from the intrusion. The TTPs were conventional: dataset pipeline RCE, credential harvest, lateral movement, self-migrating C2. The speed and alert volume were not. We mapped MITRE ATT&CK and ATLAS stages to production Elastic Defend and SIEM rules you can enable today. Full campaign analysis on the blog: go.es.io/4bg3sRK

TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it. Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload. The core DLL communicates over WebSockets and pulls additional modules from C2 on demand: Keylogger Stealer Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs 36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses. Still in active development: the shellcode injection command returns a TODO placeholder. C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch. New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago. Full technical analysis: go.es.io/4wg6i1p

This morning I was HACKED! I’m a blockchain developer with over 8 years of experience. I’m familiar with many of the techniques hackers use, but they are often one step ahead. They strike when you are most vulnerable. What happened: - A few days ago, I was contacted on LinkedIn by Kostiantyn Pustovyi. They offered me a collaboration opportunity on a Web3 game. - I immediately suspected they would send me a suspicious link, ask me to download some software, or something similar. But they didn’t. - This morning, I started the interview. The person explained the role, how I would be expected to help manage the team, and other details. - They showed me the repository I was supposed to work on. - I cloned it and ran yarn install. That’s when they got me. - An obfuscated script sent the credentials stored in process.env to their server. - They also asked me to test their online game and connect my wallet. They almost certainly intercepted my wallet password as well. I’M DESPERATE! I haven’t finished investigating yet, and I still don’t know exactly how many wallets were drained. I’ll continue posting updates as I learn more. BTSG, the bridge, and other related systems do not appear to be affected.

> Peter Stokes > Scattered Spider guy > Arrested > Microsoft helps FBI > Read court documents > Page 12 > Microsoft tracks Stokes from GDID > Microsoft Global Device Identifier (GDID) > Stokes used Windows > Page 34 > GDID assigned to each OS install > GDID unique to each device > GDID only change if OS wiped > Stokes GDID 6755467234350028 > GDID reported internet activity to Microsoft > GDID showed Stokes using Ngrok > GDID reported Stokes IP address > GDID showed Stokes web activity > GDID showed timestamps of web activity > GDID mapped with video game activity > GDID showed games played > GDID undocumented > GDID only mentioned in one MSDN document > Azure UCDOStatus > Azure Monitor Logging