Hackers are actively exploiting a new zero‑day vulnerability in Adobe Reader using a highly sophisticated malicious PDF that can steal local files and potentially lead to full system compromise.
Security researchers warn that simply opening a booby‑trapped document is enough to trigger the attack on fully up‑to‑date installations of Adobe Reader.
Zero‑day targets latest Adobe Reader
Researchers from EXPMON, a sandbox‑based exploit detection platform created by vulnerability researcher Haifei Li, detected the weaponized PDF after it was uploaded to their public analysis service under the name “yummy_adobe_exploit_uwu.pdf.”
The sample also appeared on VirusTotal with very low detection, highlighting how traditional antivirus engines are currently struggling to flag the threat.
According to the analysis, the exploit abuses an unpatched logic flaw in Adobe Reader’s JavaScript engine that allows untrusted PDF code to invoke privileged Acrobat APIs from within the sandboxed process.
The issue remains exploitable on the latest Adobe Reader build tested by researchers, meaning there is no vendor patch available at the time of writing.
The malicious PDF uses heavily obfuscated JavaScript embedded in form objects, which is decoded at runtime and executed using the Reader’s own scripting APIs.
Once running, the script collects detailed fingerprinting data, including language settings, Adobe Reader version, full operating system version, and the local file path of the opened PDF.
Crucially, the exploit can invoke the privileged util.readFileIntoStream API, allowing it to read arbitrary files accessible to the sandboxed Reader process, such as system libraries and files in system directories.
Researchers demonstrated that the exploit could read a file from the Windows system32 folder and exfiltrate it to an attacker‑controlled server, proving its ability to steal sensitive local data even without a second‑stage payload.
For command‑and‑control, the exploit abuses the RSS.addFeed API in a privileged context, using it to both send stolen information and retrieve additional JavaScript from a remote server at 169.40.2.68:45191.
The returned payload is designed to be decrypted client‑side, a technique likely intended to evade network‑based detection and content inspection.
During testing, the attacker’s server accepted connections but did not respond with further exploit code, suggesting the operation uses strict fingerprinting logic to only deliver full remote code execution (RCE) or sandbox‑escape payloads to carefully selected victims.
By redirecting the exploit to a test server, researchers confirmed that any JavaScript returned by the server would execute inside Adobe Reader, validating the path to potential RCE.
Adobe has been notified of the zero‑day, but until a patch is released, users are urged to treat unsolicited PDFs with extreme caution, especially those received via email or messaging platforms.
Organizations should closely monitor and, where appropriate, block traffic to the hard‑coded C2 endpoint 169.40.2.68:45191, while recognizing that attackers can easily rotate infrastructure.
Network defenders are advised to look for suspicious HTTP/HTTPS requests where the User‑Agent string contains “Adobe Synchronizer,” which the exploit uses for outbound communication.
Security teams can also submit suspicious PDF samples to EXPMON’s public service, which has demonstrated the ability to detect advanced, exploit‑only PDF attacks that may evade traditional malware‑centric tools.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
.webp?fit=1600,900&ssl=1&description=Security researchers warn that simply opening a booby‑trapped document is enough to trigger the attack on fully up‑to‑date installations of Adobe Reader.){kind=link}