BTIBTI-2025-0003
7.8BTSS

IdentityMatrix

IdentityMatrix HEM Extractor - Browser Storage Scanning for Email Identifiers

Version
1
Discovered
2025-11-25
Est. Deployments
5,000+
THE TAKE

IdentityMatrix's tracking script contains an extractHems() function that scans all browser storage (cookies, localStorage, sessionStorage) looking for email addresses and email hashes. Found values are transmitted for cross-reference against identity graphs for visitor de-anonymization.

This advisory exists to warn companies running IdentityMatrix on their sites. We do not notify vendors. We do not provide remediation windows. If you're using this vendor, this is your evidence.

//PREVALENCE
5,000+
Estimated Deployments
Market Segments
B2B SaaSMarketing TechnologyData Enrichment
Notable Deployments
  • IdentityMatrix's own website
  • Various B2B technology companies
//IF_YOU_ARE_RUNNING_THIS

If You're Running IdentityMatrix

immediate

Remove IdentityMatrix script if deployed

Effort: trivial
short term

Audit scripts for storage enumeration patterns

Effort: moderate
long term

Implement storage access policies via CSP

Effort: significant
//REVENUE_IMPACT

What It Costs You

CAC Subsidization

Visitor data captured on a site can flow into data broker networks and identity graphs, eventually surfacing in competitor prospecting tools. The original company paid to acquire the traffic; competitors pay pennies to intercept the lead.

Signal Corruption

Overlapping tracking mechanisms corrupt attribution data. Multiple sources claim credit for single conversions. Pipeline metrics diverge from reality. Marketing decisions get made on numbers that can’t be trusted.

Legal Tail Risk

Pre-consent data collection, undisclosed data sharing, and consent signal violations create regulatory exposure. Class actions and regulatory fines can exceed entire annual marketing budgets. Liability sits with the site owner, not the vendor.

GTM Attack Surface

Third-party scripts execute with full privileges on every page load. Dangerous code patterns, external dependencies, and data interception turn marketing infrastructure into attack vectors. One compromised dependency compromises the entire site.

//WHY_THIS_MATTERS

Attack Parallel: Cookie Stealers

Traditional cookie stealers enumerate document.cookie to exfiltrate session tokens and authentication data. HEM extractors use the same technique but extend it to localStorage and sessionStorage, searching for identity markers that enable cross-site tracking. The only difference: cookie stealers are called malware, HEM extractors are called "identity resolution" and sold as B2B SaaS.

Reference
//BTSS_BREAKDOWN

BTSS Score Breakdown

Exploitability
3.5/ 4
Data Sensitivity
2/ 3
Prevalence
1.3/ 2
Detection Difficulty
0.8/ 1
//TECHNICAL_EVIDENCE

Technical Evidence

## How HEM Extraction Works The IdentityMatrix tracking script (`trackingScript.js`) contains a function called `extractHems()` that: 1. Iterates through ALL cookies via `document.cookie.split(";")` 2. Iterates through ALL localStorage keys 3. Iterates through ALL sessionStorage keys 4. Applies regex patterns to find: - Plain email addresses (`/^[^\s@]+@[^\s@]+\.[^\s@]+$/`) - MD5 hashes (`/^[a-f0-9]{32}$/i`) - SHA-256 hashes (`/^[a-f0-9]{64}$/i`) 5. Adds found values to `VISIT_DATA.hem` array 6. Transmits everything to IdentityMatrix servers ## Why This Matters HEMs (Hashed Email Addresses) are the new currency of cross-site tracking. They enable identity resolution without cookies - if you've ever logged into a site and they hashed your email, that hash can identify you across the web. IdentityMatrix is scanning YOUR browser for emails that OTHER sites stored, then using them to identify you. ## Additional Concerning Findings On identitymatrix.ai itself: - 196 network requests on page load - Face2Face.io integration with "stalkingSessionsCount" field - 15+ ad-tech/data broker syncs - Microsoft Clarity session recording

Code Evidence

javascriptapp.identitymatrix.ai/trackingScript.js

extractHems() function - scans all browser storage

function extractHems() {
  var found = []; var seen = new Set();
  var md5Regex = /^[a-f0-9]{32}$/i;
  var sha256Regex = /^[a-f0-9]{64}$/i;
  var emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

  // Scans cookies
  document.cookie.split(";").forEach(function(cookie) {
    var parts = cookie.trim().split("=");
    var key = parts[0];
    var value = parts[1];
    if (key && value) { addHem("cookie", key, value); }
  });

  // Scans localStorage
  for (var key in localStorage) {
    if (localStorage.hasOwnProperty(key)) {
      var value = localStorage[key];
      if (value) addHem("localStorage", key, value);
    }
  }

  // Scans sessionStorage
  for (var key in sessionStorage) {
    if (sessionStorage.hasOwnProperty(key)) {
      var value = sessionStorage[key];
      if (value) addHem("sessionStorage", key, value);
    }
  }

  VISIT_DATA.hem = found;
}
javascriptapp.identitymatrix.ai/trackingScript.js

VISIT_DATA structure - all collected visitor data

var VISIT_DATA = {
  id: getTrackingID(),
  pixelId: null,
  sessionId: getSessionID(),
  domain: window.location.hostname,
  path: window.location.pathname,
  search: window.location.search,
  dateVisit: new Date().toISOString(),
  userAgent: navigator.userAgent,
  referrer: getCookie("im_session_referrer"),
  pageTitle: document.title,
  formData: null,
  hem: [],  // Hashed Email extraction results go here
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
  screenSize: window.screen.width + "x" + window.screen.height,
  viewportSize: window.innerWidth + "x" + window.innerHeight,
  language: navigator.language,
  idleTime: 0,
  clickEvents: [],
  mousePath: []
};

Network Evidence

POSThttps://api.identitymatrix.ai/track
{"hem": [...], "sessionId": "...", ...}

Visitor data including extracted HEMs transmitted to API

POSThttps://f2f-server-prod-*.herokuapp.com/visitors/

Face2Face.io integration - note 'stalking' terminology in data model

//EVIDENCE_PACKAGE

Evidence Package

Reproduction Steps

## Reproduction Steps

1. **Visit** https://www.identitymatrix.ai/
2. **Open DevTools** → Sources tab
3. **Find** trackingScript.js in the source tree
4. **Search** for "extractHems" or "localStorage"
5. **Observe** the storage enumeration code

## Alternative: Network Analysis

1. **Open DevTools** → Network tab
2. **Visit** https://www.identitymatrix.ai/
3. **Search** for requests to api.identitymatrix.ai
4. **Inspect** request payloads for "hem" field
//LEGAL_TOUCHPOINTS

Legal Touchpoints

GDPR Art. 5(1)(b)European Union

Purpose limitation - data must be collected for specified purposes. Scanning all storage to find any email is not a specified purpose, it's a fishing expedition.

GDPR Art. 5(1)(c)European Union

Data minimization - scanning ALL storage keys violates minimization. A legitimate script would access specific, known keys only.

ePrivacy Directive Art. 5(3)European Union

Accessing information stored on user's terminal equipment requires consent. Enumerating all storage is accessing stored information.

CCPA 1798.100(a)(3)California

Sensitive PI (which may be found in storage) requires opt-in consent. HEM extraction is opt-out at best, and often has no notice at all.

//CITATION_TEMPLATES

Citation Templates

For Contracts / DPAs
“Vendor shall not engage in behaviors classified under BTI-2025-0003 (IdentityMatrix), including BTI-C03 (Storage Exfiltration).”
For Compliance Reports
“BTI Advisory BTI-2025-0003 documents IdentityMatrix engaging in Storage Exfiltration (BTSS 7.8, HIGH).”
For Email / Communication
“We have identified IdentityMatrix as exhibiting Storage Exfiltration behavior per BTI Advisory BTI-2025-0003. Full details: deployblackout.com/bti/BTI-2025-0003
//RELATED_ADVISORIES
//FRAMEWORK_MAPPINGS
MITRE ATT&CK
T1539
Steal Web Session Cookie
Tactic: Collection
PCI DSS 4.0
6.4.3
OWASP Client-Side
CS2: Data Leakage
Created: 2025-11-25Updated: 2025-11-25Version: 1
#hem-extraction#storage-scanning#identity-resolution#high#identitymatrix
Permanent URL: deployblackout.com/bti/BTI-2025-0003