A highly sophisticated zero-day vulnerability in Adobe Reader is currently being exploited by hackers. Since December 2024, attackers have used malicious PDF documents to target users, even those running the most up-to-date versions of the software.
How the Attack Works
The infection triggers immediately when a user opens a compromised PDF. Using obfuscated JavaScript, the exploit performs system mapping and collects sensitive data. Common lures include files named "Invoice540.pdf" and documents targeting the oil and gas sector, indicating a focus on corporate and geopolitical espionage.
Technical Risks
- Automatic Activation: Code runs instantly upon opening the file.
- System Escape: Hackers can bypass protection layers to execute remote code.
- Data Theft: The malware abuses Acrobat APIs to read local files and send them to remote servers.
As of now, Adobe has not released an official patch. Users are advised to exercise extreme caution when opening PDF files from unknown or unverified sources.
