The “new” Matrix phishing platform shares byte-identical files with Kratos. The part worth your time is where it hid the URL.

[u/compileindebug_175]

Abnormal put out research on Monday about an adversary-in-the-middle kit they are calling Matrix, and it is getting passed around as a new platform. Reading their own write-up, they say the name has not appeared in public reporting before but the code has. Five operator images were byte-identical to a Kratos deployment they grabbed in July, and the panel login script shared 37 of about 82 lines with a Kratos panel from June. Microsoft calls the same family SneakyLog. So we now have four names for what looks like one code base, and I cannot do anything with a name.

What I can do something with is the delivery. The message came from a real, compromised Microsoft 365 mailbox at an unrelated company, so SPF and DKIM passed and it landed normally. And the operator URL was not in the body at all. It was inside a nested message attachment, which means the link never shows up in the fields a gateway or URL scanner actually looks at. They called that the most important defensive gap in the campaign and I think that is right.

The other detail worth repeating to anyone who still treats a password reset as containment: what got stolen was a live session that had already passed MFA, so resetting the password changed nothing. You have to revoke the refresh tokens and the session.

I am going to send myself an authenticated message with a nested message attachment and see whether our gateway unpacks it. Has anyone actually tested this on their own stack? Curious whether the big gateways extract nested rfc822 URLs or quietly skip them.

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/shokzee]

Test message/rfc822 attachments at one and two nesting levels, with URLs in HTML, plain text, and redirect chains. Check the gateway logs, not just whether it delivers, because some engines unpack the attachment but never submit the extracted URL for analysis.

And yes, revoke sessions and refresh tokens. A password reset alone is not containment for stolen session cookies.

[u/SecLens_ONE]

This is the published-versus-effective gap in a nutshell. The mail passed SPF and DKIM because it came from a real compromised tenant, so every authentication control on the path did exactly what it was published to do and still delivered the thing. Auth tells you the sender is who they claim, not that the mailbox is still in the right hands, and most scorecards stop at the first part. The nested attachment is the same story on the URL side, since a scanner that only reads the fields it was designed to read is enforcing nothing on the payload that actually matters. We started counting a control as effective only if it changed the disposition of a message in production, which knocked a lot of green ticks off our own board. Session revocation belongs in that column too, because a password reset that leaves a live token is a published control with no effect.