Loading story…
Threat actors are exploiting browser push notifications as a novel vector for fileless, cross-platform phishing attacks using a new command-and-control (C2) platform called Matrix Push C2. This framework leverages social engineering to trick users into granting notification permissions on either malicious or compromised legitimate websites. Once access is granted, attackers send notifications that mimic trusted system or browser alerts, often impersonating brands like Cloudflare, PayPal, or Google Chrome, to lure victims into clicking links that redirect to phishing or malware sites. The entire attack chain operates within the browser, bypassing traditional security controls and requiring no initial malware infection, making it effective across all operating systems.
Matrix Push C2 is marketed as a malware-as-a-service (MaaS) kit, sold via cybercrime forums and Telegram, and provides a dashboard for attackers to manage campaigns, customize notification content, and track victim interactions. Features include analytics on delivery and click rates, victim system details, and the ability to impersonate various brands. The service's fileless nature and cross-platform reach make it a significant threat, as it enables persistent communication with compromised users and circumvents common email-based security defenses. Security researchers warn that this approach could see increased adoption due to its effectiveness and ease of use for cybercriminals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security reporting documented that attackers were using browser notifications from malicious or compromised sites to trick users into clicking harmful links, with Matrix Push C2 identified as a key platform enabling the activity. The attacks relied on social engineering and brand impersonation to increase user trust and drive credential theft, malware installation, or data theft.
Threat actors began using Matrix Push C2, a browser-native malware-as-a-service platform, to abuse browser notifications for delivering malicious links in fileless, cross-platform phishing attacks. The service was marketed through crimeware channels with features such as phishing templates, victim tracking, and analytics.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly leveraging legitimate IT tools and browser features to gain unauthorized access to victims' systems and steal credentials. Recent campaigns have exploited Remote Monitoring and Management (RMM) software such as LogMeIn Resolve (GoToResolve) and PDQ Connect, tricking users into installing these trusted applications under false pretenses. Once installed, these tools provide attackers with full remote access, often bypassing traditional security controls due to their legitimate nature. Attackers distribute these installers through convincing phishing emails and fake websites that mimic popular utility download pages, using legitimate domains like Dropbox to evade detection. The attackers pre-configure the RMM tools with their own identifiers, allowing seamless control over compromised systems. In parallel, social engineering attacks are evolving to exploit browser features and cloned websites. The ClickFix attack, for example, uses fake ChatGPT Atlas browser installers distributed via cloned sites and sponsored search results to deliver password-stealing malware. Similarly, the Matrix Push C2 platform abuses browser push notifications as a fileless attack vector, tricking users into enabling notifications that deliver fake system alerts and redirect to malicious sites. These techniques rely on the inherent trust users place in familiar brands and browser features, making them highly effective at bypassing both technical and human defenses.
Jun 29, 2026
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026
MatrixPDF is a newly discovered phishing and malware deployment toolkit that allows cybercriminals to weaponize ordinary PDF files for malicious purposes. The toolkit was first identified by Varonis researchers on cybercrime forums, where it is marketed as both a phishing simulation and a blackteaming tool. MatrixPDF enables attackers to import legitimate PDF documents and augment them with a variety of deceptive features, including fake secure document prompts, custom icons such as padlocks or corporate logos, and content blur overlays that obscure the real content until the user interacts with the file. One of the most dangerous aspects of MatrixPDF is its ability to embed JavaScript actions within the PDF, which can execute code when the document is opened or when a user clicks on specific elements. This functionality allows attackers to redirect victims to external payload URLs, leading to credential theft or malware downloads. The toolkit is designed to bypass common email security filters, particularly those used by Gmail, by making the malicious PDFs appear routine and trustworthy to recipients. MatrixPDF offers a drag-and-drop interface, real-time preview, and customizable security overlays, making it accessible even to less technically skilled threat actors. The tool is sold under various pricing plans, ranging from $400 per month to $1,500 per year, and is distributed via cybercrime forums and Telegram. Built-in protections such as metadata encryption and secure redirect mechanisms are advertised to enhance the authenticity and delivery reliability of the malicious PDFs. The toolkit's features are specifically tailored to evade detection and increase the likelihood of successful phishing or malware campaigns. Attackers can specify payload URLs that the PDF will invoke, enabling seamless redirection to phishing sites or malware downloads after victim interaction. The use of overlays and blurred content further enhances the social engineering aspect, tricking users into believing they are unlocking a secure document. MatrixPDF's emergence highlights the ongoing evolution of phishing tactics, leveraging trusted file formats and sophisticated obfuscation techniques. Security researchers warn that the toolkit's ease of use and effectiveness could lead to a surge in PDF-based phishing and malware attacks targeting both individuals and organizations. Organizations are advised to update their email security protocols and educate users about the risks associated with opening unsolicited PDF attachments. The discovery of MatrixPDF underscores the need for continuous vigilance and advanced threat detection capabilities to counter increasingly sophisticated social engineering tools.
Jun 29, 2026