Q:

Whom vs Who: object Judas + whom

The test itself lies in attempting to apply this new update to a card belonging to Judas, whom is a legitimate user of the system. 

Is Judas considered the subject or the object?  I'm considering Judas to be the object and hence applying whom after the comma.  Is this correct? 
I read about whom vs who at LINK, but I'm not sure if I'm applying it correctly to this case.  I've also tried the whom+him test by asking Whom does the card belong to?  with the answer It belongs to him. 

A:

The name Judas is indeed the object of the phrase in which it appears.   However, this has no bearing on the selection of pronoun in a subsequent phrase, where the name can be used in a different function. 
If you apply the "whom/him" test to the phrase where you're actually trying to use who/whom, you'll get 

Who is a legitimate user of the system?   He is a legitimate user of the system. 

as opposed to the clearly incorrect version:

Whom is a legitimate user of the system?   Him is a legitimate user of the system.