Hackers Using New Matrix Push C2 to Deliver Malware and Phishing Attacks via Web Browser

A new command-and-control platform called Matrix Push C2 has emerged as a serious threat to web users across all operating systems.

This browser-based attack framework turns legitimate web browser features into a weapon for delivering malware and phishing attacks.

Unlike traditional malware that requires file downloads, Matrix Push C2 operates silently through a fileless attack method, making it harder to detect and stop.

The platform exploits web push notifications, a standard feature in modern browsers, to establish direct communication channels with infected devices.

Attackers use this connection to deliver fake system alerts, redirect users to malicious websites, monitor victim activity in real time, and even scan for cryptocurrency wallets.

The beauty of this attack from the cybercriminal’s perspective is that it bypasses many traditional security tools because it appears to come from the browser itself rather than external malware.

Blackfog security analysts identified the malware’s sophisticated approach to victim targeting and engagement.

The Matrix Push C2 dashboard provides attackers with detailed analytics showing infected browsers, notification delivery rates, and user interaction data.

With just three test clients, the researchers observed a 100 percent delivery success rate, demonstrating how effective this attack vector could be at scale.

How the Infection Mechanism Works

The attack begins with social engineering. Attackers trick users into allowing browser notifications through malicious or compromised websites.

Once a user subscribes to these notifications, the attacker gains a direct communication line to the victim’s desktop or mobile device.

From that point forward, the attacker can push out convincing fake error messages and security alerts that look like they come from trusted companies or the operating system itself.

When users click these deceptive notifications, they are redirected to attacker-controlled websites hosting phishing pages or malware downloads.

For example, a fake notification might display “Update required! Please update Google Chrome to avoid data loss!” and direct users to download trojanized software.

The entire attack happens through the browser’s notification system without requiring traditional malware installation.

What makes Matrix Push C2 particularly dangerous is its use of brand-themed phishing templates. The platform includes pre-built templates mimicking PayPal, Netflix, Cloudflare, MetaMask, and other trusted services.

Attackers can customize these templates to match official designs perfectly, exploiting user trust in recognized brands.

Real-time monitoring capabilities allow attackers to track which notifications were delivered, which users clicked them, and gather valuable device information, creating a complete attack orchestration platform.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.