‘Matrix Push’ C2 Tool Hijacks Browser Notifications for Phishing

Matrix Push is a new, user-friendly C2 tool described as a framework for turning browser notifications into a phishing vector. According to BlackFog, attackers can design notifications that look legitimate but point victims to malicious sites, and from the Matrix Push dashboard they can monitor data such as how many victims have been reached, their location, IP addresses, and browser and OS details.

The technique relies on social engineering to get a user to enable browser notifications, after which the attacker registers a service worker and a Push API subscription to deliver phishing messages through the browser’s native notifications. The tool is sold on the cybercrime underground with a tiered pricing model: $150 per month, or $405 for three months, $765 for six months, or $1,500 for a full year.

Officials note that the notifications traffic uses encrypted push traffic via the browser vendor’s push service, which helps it evade traditional detection. Published on 20 November 2025, the report highlights the need for browser developers and security tools to implement stronger protections and for users to review permissions regularly.