A new phishing and malware distribution toolkit called MatrixPDF allows attackers to convert ordinary PDF files into interactive lures that bypass email security and redirect victims to credential theft or malware downloads.

The new tool was spotted by Varonis researchers, who told BleepingComputer that MatrixPDF was first spotted on a cybercrime forum. The seller also uses Telegram as an additional means of interacting with buyers.

The developer of MatrixPDF promotes the tool as a phishing simulation and blackteaming tool. However, Varonis researcher Daniel Kelley told BleepingComputer that it was first seen being offered on cybercrime forums.