MatrixPDF Campaign Evades Gmail Filters to Deliver Malicious Payloads

MatrixPDF Campaign Evades Gmail Filters to Deliver Malicious Payloads describes a growing social engineering campaign that splits malicious activity across multiple platforms to evade detection. The toolkit hijacks ordinary PDF files, adding fake security prompts, embedded JavaScript actions, content blur overlays, and external redirects to deliver malware while appearing routine to recipients.

According to the article, the first attack vector leverages Gmail’s PDF preview to bypass email gateway filters, with MatrixPDF-generated files passing initial scans and prompting users to open a “Secure Document” via blurred content and overlays. A second method uses PDF-embedded JavaScript to fetch payloads from attacker-controlled URLs, with the download often masquerading as a legitimate PuTTY installer hosted on a public site, and JavaScript API calls enabling the fetch after user permission.

The campaign has been described as a malicious toolkit discovered on cybercrime networks, according to Varonis. The piece also notes that traditional filters struggle because many malicious components only activate through user interaction, and it advocates AI-powered security and cloud sandboxing to analyse complete attack chains.