Cybercriminals are exploiting Obsidian's community plugins in an elaborate scam to deploy malware and gain device control over crypto and finance professionals.