Once victims open the vault and enable community plugins, the attack is triggered automatically—no suspicious downloads or obvious warnings required. The malware, named PHANTOMPULSE, can silently take control of the victim’s device, making it particularly dangerous for individuals managing crypto assets.

This attack highlights a growing trend: hackers are no longer relying solely on phishing links or fake websites. Instead, they are exploiting trusted tools and workflows, making scams harder to detect and more convincing for even experienced users.