While old threat vectors are being exploited in the crypto industry, making a popular wallet the latest victim, a novel campaign abusing a popular note-taking application has been found.

On Wednesday, the Zerion wallet disclosed that after their team members' devices were compromised, Democratic People's Republic of Korea (DPRK)-linked criminals managed to steal $100,000 worth of unspecified crypto assets from the company's hot wallets.

The team claims that it was an AI-enabled social engineering attack.

"This allowed the attacker to gain access to some of the team members’ logged-in sessions and credentials as well as private keys to company hot wallets used for testing and internal purposes," Zerion said, adding that the criminals were "clearly sophisticated and well-resourced."

The team encouraged everyone in the crypto industry to verify all links carefully, treat unexpected permission prompts with suspicion, and be wary of AI-generated video in meeting scenarios.

Meanwhile, cybersecurity firm Elastic Security Labs said it has uncovered a social engineering campaign on LinkedIn and Telegram that abuses Obsidian's legitimate community plugin ecosystem, specifically the Shell Commands and Hider plugins, to execute code when a victim opens a shared cloud vault.

According to the findings, the criminals behind this campaign pose as a venture capital firm and target victims in the financial and crypto industries on LinkedIn, tricking them into using Obsidian, which they claim is the firm's "management database."

With the provided credentials, the potential victim connects to a cloud-hosted vault controlled by the attacker, after which the trojanized plugins execute the attack chain.

"By abusing Obsidian's community plugin ecosystem rather than exploiting a software vulnerability, the attackers bypass traditional security controls entirely, relying on the application's intended functionality to execute arbitrary code," Elastic Security Labs concluded, urging organizations to be aware that legitimate productivity tools can be turned into attack vectors.

---

Unlock more exclusive Cybernews content on YouTube.