Loading malware…
MatrixPDF is a malicious PDF builder/toolkit sold in the cybercrime ecosystem to weaponize ordinary PDF files into phishing or malware lures. Reported capabilities include adding fake login overlays, redirects, and embedded actions to PDF documents in order to redirect victims to phishing pages or malware sites and to help bypass email filters. The content describes MatrixPDF as part of the broader subscription-style crime-as-a-service market that lowers the barrier to entry for attackers by providing turnkey tooling. It is associated with phishing-focused criminal activity rather than a specific named threat actor in the provided content. High-confidence behavior described includes converting benign PDFs into weaponized lures, use in phishing delivery, and evasion of email filtering through manipulated PDF content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious PDF/document builder used to weaponize PDFs for phishing (e.g., fake login overlays, redirects) and evade email filtering.
MatrixPDF is a toolkit for creating weaponized PDF files with overlays, redirects, and embedded actions to bypass email security and deliver phishing or malware payloads.
MatrixPDF is a toolkit that allows threat actors to modify legitimate PDF files, embedding phishing and malware features such as fake secure document prompts, embedded JavaScript, content blurring, and redirects. It is used to deliver phishing lures and malware payloads via seemingly benign PDF documents.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.