Loading story…
MatrixPDF is a newly discovered phishing and malware deployment toolkit that allows cybercriminals to weaponize ordinary PDF files for malicious purposes. The toolkit was first identified by Varonis researchers on cybercrime forums, where it is marketed as both a phishing simulation and a blackteaming tool. MatrixPDF enables attackers to import legitimate PDF documents and augment them with a variety of deceptive features, including fake secure document prompts, custom icons such as padlocks or corporate logos, and content blur overlays that obscure the real content until the user interacts with the file. One of the most dangerous aspects of MatrixPDF is its ability to embed JavaScript actions within the PDF, which can execute code when the document is opened or when a user clicks on specific elements. This functionality allows attackers to redirect victims to external payload URLs, leading to credential theft or malware downloads. The toolkit is designed to bypass common email security filters, particularly those used by Gmail, by making the malicious PDFs appear routine and trustworthy to recipients. MatrixPDF offers a drag-and-drop interface, real-time preview, and customizable security overlays, making it accessible even to less technically skilled threat actors. The tool is sold under various pricing plans, ranging from $400 per month to $1,500 per year, and is distributed via cybercrime forums and Telegram. Built-in protections such as metadata encryption and secure redirect mechanisms are advertised to enhance the authenticity and delivery reliability of the malicious PDFs. The toolkit's features are specifically tailored to evade detection and increase the likelihood of successful phishing or malware campaigns. Attackers can specify payload URLs that the PDF will invoke, enabling seamless redirection to phishing sites or malware downloads after victim interaction. The use of overlays and blurred content further enhances the social engineering aspect, tricking users into believing they are unlocking a secure document. MatrixPDF's emergence highlights the ongoing evolution of phishing tactics, leveraging trusted file formats and sophisticated obfuscation techniques. Security researchers warn that the toolkit's ease of use and effectiveness could lead to a surge in PDF-based phishing and malware attacks targeting both individuals and organizations. Organizations are advised to update their email security protocols and educate users about the risks associated with opening unsolicited PDF attachments. The discovery of MatrixPDF underscores the need for continuous vigilance and advanced threat detection capabilities to counter increasingly sophisticated social engineering tools.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Security researchers reported on MatrixPDF, a toolkit that weaponizes PDF attachments to deliver phishing pages and malware lures, with Gmail users highlighted as a target. The reporting describes the toolkit's use of malicious PDFs as an initial access and social-engineering mechanism.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers sharply expanded the use of malicious PDF files in phishing campaigns, with observed samples rising from **411,800** in 2019 to **5,224,056** in 2020, according to Palo Alto Networks Unit 42. Researchers identified five dominant lure themes: fake CAPTCHA, coupons, play buttons, file sharing, and e-commerce. Fake CAPTCHA PDFs accounted for nearly **40%** of observed samples and commonly pushed victims toward browser notification abuse, malvertising, and in some cases malicious Chrome extension installation. Many of the campaigns relied on traffic redirection to evade takedowns, swap final landing pages, and monetize victims through affiliate-style schemes. File-sharing themed PDFs were also used for credential theft by impersonating services including **Dropbox**, **OneDrive**, **Atlassian**, and **Microsoft** login pages. The report also published indicators of compromise, redirector domains, final hosts, and **YARA** rules to help defenders detect several categories of PDF-based phishing activity.
Aug 15, 2026
Threat actors are exploiting browser push notifications as a novel vector for fileless, cross-platform phishing attacks using a new command-and-control (C2) platform called Matrix Push C2. This framework leverages social engineering to trick users into granting notification permissions on either malicious or compromised legitimate websites. Once access is granted, attackers send notifications that mimic trusted system or browser alerts, often impersonating brands like Cloudflare, PayPal, or Google Chrome, to lure victims into clicking links that redirect to phishing or malware sites. The entire attack chain operates within the browser, bypassing traditional security controls and requiring no initial malware infection, making it effective across all operating systems. Matrix Push C2 is marketed as a malware-as-a-service (MaaS) kit, sold via cybercrime forums and Telegram, and provides a dashboard for attackers to manage campaigns, customize notification content, and track victim interactions. Features include analytics on delivery and click rates, victim system details, and the ability to impersonate various brands. The service's fileless nature and cross-platform reach make it a significant threat, as it enables persistent communication with compromised users and circumvents common email-based security defenses. Security researchers warn that this approach could see increased adoption due to its effectiveness and ease of use for cybercriminals.
Jun 29, 2026
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026