Obsidian plugin was abused to deploy a remote access trojan

Re:Obsidian plugin was abused to deploy a remote access trojan by embedding-shape on Monday May 11, 2026 @08:34AM (#48094166)

Does that help in this case though? I think the worry is that a rogue Obsidian plugin does bad stuff with your Obsidian vault, not just do stuff to the rest of the computer. But that vault/those notes live in the same sandbox as the (rogue) 3rd party plugin, which doesn't help with that, they really need to be isolated away from the notes themselves.

[ Parent | on HN ]

Re:Obsidian plugin was abused to deploy a remote access trojan by zerkten on Monday May 11, 2026 @01:01PM (#48097599)

Anything that reduces the blast radius helps. There should still be a focus on further hardening. Most value comes from exploits that enable pivots. Attackers will focus on other vectors that enable broader pivots because immediate high value notes only exist for a limited set of users.

[ Parent | on HN ]

Re:Obsidian plugin was abused to deploy a remote access trojan by jon-wood on Tuesday May 12, 2026 @10:16AM (#48108646)

In this case, no, not really because the plugin is running within the same sandbox. I was addressing the more general point in the grandparent post.

[ Parent | on HN ]