Product
Shell Commands
- First Reported
- Apr 13, 2026
- Latest Reported
- Apr 13, 2026
Reported Context (1)
- The campaign used LinkedIn/Telegram lures, trojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with Telegram Elastic Details REF6598 Campaign Abusing Obsidian Plugins to Deliver PHANTOMPULSE RAT
Malware (2)
MITRE ATT&CK (15)
Vendors (1)
Products (5)
Industries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.