INVESTIGATING — Active analysis in progress. Findings preliminary.
BTIBTI-2025-0003
HIGHBTI-C03INVESTIGATING
7.8BTSS

IdentityMatrix

IdentityMatrix HEM Extractor - Browser Storage Scanning for Email Identifiers

Discovered
2025-11-25
Est. Deployments
5,000+
MITRE Technique
T1539
Trend
increasing

Summary

IdentityMatrix's tracking script contains an extractHems() function that scans all browser storage (cookies, localStorage, sessionStorage) looking for email addresses and email hashes. Found values are transmitted for cross-reference against identity graphs for visitor de-anonymization.

BTSS Score Breakdown

Exploitability
3.5/ 4
Data Sensitivity
2/ 3
Prevalence
1.3/ 2
Detection Difficulty
0.8/ 1

Technical Details

## How HEM Extraction Works The IdentityMatrix tracking script (`trackingScript.js`) contains a function called `extractHems()` that: 1. Iterates through ALL cookies via `document.cookie.split(";")` 2. Iterates through ALL localStorage keys 3. Iterates through ALL sessionStorage keys 4. Applies regex patterns to find: - Plain email addresses (`/^[^\s@]+@[^\s@]+\.[^\s@]+$/`) - MD5 hashes (`/^[a-f0-9]{32}$/i`) - SHA-256 hashes (`/^[a-f0-9]{64}$/i`) 5. Adds found values to `VISIT_DATA.hem` array 6. Transmits everything to IdentityMatrix servers ## Why This Matters HEMs (Hashed Email Addresses) are the new currency of cross-site tracking. They enable identity resolution without cookies - if you've ever logged into a site and they hashed your email, that hash can identify you across the web. IdentityMatrix is scanning YOUR browser for emails that OTHER sites stored, then using them to identify you. ## Additional Concerning Findings On identitymatrix.ai itself: - 196 network requests on page load - Face2Face.io integration with "stalkingSessionsCount" field - 15+ ad-tech/data broker syncs - Microsoft Clarity session recording

Code Evidence

javascriptapp.identitymatrix.ai/trackingScript.js

extractHems() function - scans all browser storage

function extractHems() {
  var found = []; var seen = new Set();
  var md5Regex = /^[a-f0-9]{32}$/i;
  var sha256Regex = /^[a-f0-9]{64}$/i;
  var emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

  // Scans cookies
  document.cookie.split(";").forEach(function(cookie) {
    var parts = cookie.trim().split("=");
    var key = parts[0];
    var value = parts[1];
    if (key && value) { addHem("cookie", key, value); }
  });

  // Scans localStorage
  for (var key in localStorage) {
    if (localStorage.hasOwnProperty(key)) {
      var value = localStorage[key];
      if (value) addHem("localStorage", key, value);
    }
  }

  // Scans sessionStorage
  for (var key in sessionStorage) {
    if (sessionStorage.hasOwnProperty(key)) {
      var value = sessionStorage[key];
      if (value) addHem("sessionStorage", key, value);
    }
  }

  VISIT_DATA.hem = found;
}
javascriptapp.identitymatrix.ai/trackingScript.js

VISIT_DATA structure - all collected visitor data

var VISIT_DATA = {
  id: getTrackingID(),
  pixelId: null,
  sessionId: getSessionID(),
  domain: window.location.hostname,
  path: window.location.pathname,
  search: window.location.search,
  dateVisit: new Date().toISOString(),
  userAgent: navigator.userAgent,
  referrer: getCookie("im_session_referrer"),
  pageTitle: document.title,
  formData: null,
  hem: [],  // Hashed Email extraction results go here
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
  screenSize: window.screen.width + "x" + window.screen.height,
  viewportSize: window.innerWidth + "x" + window.innerHeight,
  language: navigator.language,
  idleTime: 0,
  clickEvents: [],
  mousePath: []
};

Network Evidence

POSThttps://api.identitymatrix.ai/track
{"hem": [...], "sessionId": "...", ...}

Visitor data including extracted HEMs transmitted to API

POSThttps://f2f-server-prod-*.herokuapp.com/visitors/

Face2Face.io integration - note 'stalking' terminology in data model

Attack Parallel: Cookie Stealers

Traditional cookie stealers enumerate document.cookie to exfiltrate session tokens and authentication data. HEM extractors use the same technique but extend it to localStorage and sessionStorage, searching for identity markers that enable cross-site tracking. The only difference: cookie stealers are called malware, HEM extractors are called "identity resolution" and sold as B2B SaaS.

Reference

Framework Mappings

MITRE ATT&CK
T1539
Steal Web Session Cookie
Tactic: Collection
PCI DSS 4.0
6.4.3
OWASP Client-Side
CS2: Data Leakage

Legal Touchpoints

GDPR Art. 5(1)(b)European Union

Purpose limitation - data must be collected for specified purposes. Scanning all storage to find any email is not a specified purpose, it's a fishing expedition.

GDPR Art. 5(1)(c)European Union

Data minimization - scanning ALL storage keys violates minimization. A legitimate script would access specific, known keys only.

ePrivacy Directive Art. 5(3)European Union

Accessing information stored on user's terminal equipment requires consent. Enumerating all storage is accessing stored information.

CCPA 1798.100(a)(3)California

Sensitive PI (which may be found in storage) requires opt-in consent. HEM extraction is opt-out at best, and often has no notice at all.

Prevalence

5,000+
Estimated Deployments
Market Segments
B2B SaaSMarketing TechnologyData Enrichment
Notable Deployments
  • IdentityMatrix's own website
  • Various B2B technology companies

Reproduction Steps

## Reproduction Steps

1. **Visit** https://www.identitymatrix.ai/
2. **Open DevTools** → Sources tab
3. **Find** trackingScript.js in the source tree
4. **Search** for "extractHems" or "localStorage"
5. **Observe** the storage enumeration code

## Alternative: Network Analysis

1. **Open DevTools** → Network tab
2. **Visit** https://www.identitymatrix.ai/
3. **Search** for requests to api.identitymatrix.ai
4. **Inspect** request payloads for "hem" field

Remediation

immediate

Remove IdentityMatrix script if deployed

Effort: trivial
short term

Audit scripts for storage enumeration patterns

Effort: moderate
long term

Implement storage access policies via CSP

Effort: significant
Created: 2025-11-25Updated: 2025-11-25Version: 1
#hem-extraction#storage-scanning#identity-resolution#high#identitymatrix