Malware, phishing facilitated by novel MatrixPDF toolkit

Ordinary PDF files could be transformed into stealthy phishing lures resulting in malware injections or credential compromise through the newly emergent MatrixPDF phishing and malware distribution toolkit, reports BleepingComputer.

Threat actors could leverage MatrixPDF which has been touted as a phishing simulation and blackteaming tool available in subscription plans ranging from $400 to $1,500 to lace innocuous PDFs with bogus "Secure Document" prompts, blurred content, clickable overlays, and JavaScript actions enabling redirections to phishing pages or malware-distributing sites, according to an analysis from Varonis researchers.

Malicious PDFs crafted using the platform were also able to evade Gmail's phishing filters due to the email client's approval of clickable links or annotations.

"This somewhat clever design works around Gmail's security: any malware scanning of the PDF itself finds nothing incriminating, and the actual malicious content is only fetched once the user actively clicks, appearing to Gmail as a user-initiated web request," researchers added.