Matrix Push C2 Framework

TJ Mack@TJMack25

•updated Dec 4, 2025•23•1•187

This detection looks for browser network traffic to URLs containing common social engineering keywords and common web page file extensions, while excluding trusted domains. This activity is associated with the Matrix Push C2 framework, which uses malicious browser notifications to lure users to phishing pages.