Bad actors are leveraging browser notifications as a vector for phishing attacks to deliver malicious links through a new command-and-control (C2) platform called Matrix Push C2.
“This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems,” BlackFog researcher Brenda Robb said in Thursday’s report.
In these attacks, potential targets are tricked into allowing browser information through social engineering on malicious or legitimate-but-compromised websites.
Once a user agrees to receive notifications from the site, the attackers take advantage of the web push notification mechanism built into the web browser to send alerts that look as if they were sent by the operating system or browser itself, leveraging trusted branding, familiar logos, and trusted language to carry out the trick.
These include alerts about suspicious logins or browser updates, as well as a handy “Verify” or “Update” button that, when clicked, takes the victim to the fake site.
What makes it a clever technique is that the entire process takes place through the browser and does not require infecting the victim’s system through any other means. In a way, this attack is like ClickFix in that users are lured into following certain instructions to compromise their own systems, effectively bypassing traditional security controls.
Not only this. Since the attack occurs through a web browser, it is also a cross-platform threat. This effectively entitles any browser application on any platform to be listed in the pool of clients that subscribe to malicious notifications, giving adversaries a continuous communication channel.
Matrix Push C2 is offered as a malware-as-a-service (MaaS) kit for other threat actors. It is sold directly through crimeware channels, typically through Telegram and cybercrime forums, under a tiered subscription model: about $150 for one month, $405 for three months, $765 for six months, and $1,500 for a full year.
“Payments are accepted in cryptocurrencies and buyers communicate directly with the operator for access,” Dr. Darren Williams, founder and CEO of BlackFog, told The Hacker News. “Matrix Push was first seen in early October and has been active since then. There is no evidence of an older version, earlier branding or long-gone infrastructure. Everything indicates that this is a newly launched kit.”
The tool is accessible as a web-based dashboard, allowing users to send notifications, track each victim in real-time, determine which victims interacted with information, create shortened links using the built-in URL shortening service, and even record installed browser extensions, including cryptocurrency wallets.
“The core of the attack is social engineering, and Matrix Push C2 comes with configurable templates to maximize the credibility of its fake messages,” Robb explains. “Attackers can easily theme their phishing notifications and landing pages to impersonate well-known companies and services.”
Some of the supported notification verification templates are associated with well-known brands like MetaMask, Netflix, Cloudflare, PayPal, and TikTok. The platform also includes an “Analytics & Reports” section that allows its clients to measure the effectiveness of their campaigns and refine them as needed.
“Matrix Push C2 shows us a shift in how attackers gain early access and attempt to exploit users,” Blackfog said. “Once a user’s endpoint (computer or mobile device) is exposed to such influence, the attacker can gradually escalate the attack.”
“They may deliver additional phishing messages to steal credentials, trick the user into installing more frequent malware, or even take advantage of browser exploits to gain deeper control over the system. Ultimately, the end goal is often to steal data or monetize access, for example, by draining cryptocurrency wallets or exfiltrating personal information.”
Velociraptor abuse attacks are increasing
The development comes as Huntress said it has seen a “significant increase” in attacks weaponizing the legitimate VelociRaptor digital forensics and incident response (DFIR) tool over the past three months.
On November 12, 2025, the cybersecurity vendor said that threat actors deployed VelociRaptor after gaining initial access through the exploitation of a flaw in Windows Server Update Services (CVE-2025-59287, CVSS score: 9.8), which was patched by Microsoft late last month.
Next, the attackers are said to have launched search queries with the goal of conducting reconnaissance and gathering details about users, running services, and configurations. Huntress said the attack was stopped before it could escalate further.
The finding reveals that threat actors are not only using custom C2 frameworks, but also readily available offensive cybersecurity and incident response tools to their advantage.
Huntress researchers said, “We’ve seen threat actors use legitimate tools long enough to know that VelociRaptor won’t be the first dual-use, open-source tool to emerge in attacks – nor will it be the last.”
