PHANTOMPULSE Propose Change

According to Elastic Security Labs, PHANTOMPULSE is a 64-bit Windows RAT, delivered in a social engineering campaign that abuses Obsidian's Shell Commands community plugin, and is loaded reflectively in memory by a custom loader named PHANTOMPULL. The implant shows strong signs of AI-assisted development, such as abnormally verbose, self-documenting debug strings with a structured step-numbering pattern, and its operators run an equally AI-generated web panel called "Phantom Panel". It resolves its C2 server from transaction data posted to an Ethereum wallet, queried on three blockchains (Ethereum, Base, Optimism) and XOR-decrypted with the wallet address as key, with a hardcoded C2 as fallback; since the sender of the transaction is not verified, anyone can override this resolution. Over HTTPS via WinHTTP, it sends detailed system telemetry and supports commands for injecting shellcode, DLLs or executables into other processes via module stomping, dropping and executing files, taking screenshots, keylogging, elevating to SYSTEM via a COM elevation moniker, and removing its own persistence.

References

Yara Rules

rule win_phantompulse_w0 {
    meta:
        author = "Elastic Security"
        id = "eaaa34fb-eb17-433a-ba0c-f5245cb581b4"
        fingerprint = "36f5a16a014b315dc04c4c8f59bc3b653b17d0f67b5723a6b662b58709845008"
        creation_date = "2026-04-13"
        last_modified = "2026-05-05"
        threat_name = "Windows.Trojan.PhantomPulse"
        reference_sample = "9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085d"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phantompulse"
        malpedia_version = "20261012"
        malpedia_license = "Elastic License v2"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $a = "[UNINSTALL 2/6] Removing Scheduled Task..." fullword
        $b = "PhantomInject: host PID=%lu" fullword
        $c = "inject: shellcode detected -> InjectShellcodePhantom" fullword
        $d = "inject: shellcode detected, using phantom section hijack" fullword
    condition:
        all of them
}