Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks

Matrix Push C2 is a browser-native, fileless framework that uses push notifications, fake alerts, and link redirects to deliver phishing campaigns across operating systems, according to The Hacker News. Bad actors stock the MaaS kit with a web-based dashboard that lets operators send notifications, track victims in real time, shorten links, and even record installed browser extensions, including cryptocurrency wallets.

The service is sold on crimeware channels via Telegram and forums, with a tiered pricing model of about $150 for one month, $405 for three months, $765 for six months, and $1,500 for a full year, and payments are accepted in cryptocurrency, according to Dr. Darren Williams, founder and CEO of BlackFog.

The approach leverages the web push notification mechanism to appear as though alerts come from the OS or browser, featuring trusted branding and familiar logos, and victims are prompted to click a “Verify” or “Update” button that redirects to a bogus site. The campaign is cross‑platform, turning any subscribed browser application into a client and providing a persistent C2 channel, with the first observed activity beginning in October.