Sophisticated Adobe Reader Zero-Day Exploit Targets Global Users via Malicious PDFs

Cybersecurity researchers have identified a highly sophisticated zero-day vulnerability in Adobe Reader that has been actively exploited by threat actors since at least December 2025.

The flaw, uncovered by EXPMON researcher Haifei Li, allows attackers to bypass standard security protocols using maliciously crafted PDF documents. The first evidence of the campaign surfaced on VirusTotal in late November 2025, with subsequent samples appearing as recently as March 2026.

The attack primarily relies on social engineering, utilizing files with deceptive names like "Invoice540.pdf" to trick users into opening them. According to security researcher Gi7w0rm, recent iterations of the campaign have featured Russian-language lures specifically referencing current events within the Russian oil and gas industry. Once a target opens the document, the exploit triggers obfuscated JavaScript that abuses unpatched, privileged Acrobat APIs. This allows the malware to function even on the latest, fully updated versions of Adobe Reader.

The primary function of the current exploit is broad information harvesting and advanced system fingerprinting. Once the initial breach occurs, the malware exfiltrates sensitive local data to a remote server and remains poised to receive additional JavaScript payloads. While the full extent of the secondary phase remains a mystery due to the command-and-control server’s selective responses, experts warn that the framework is designed for remote code execution and sandbox escapes.

Haifei Li noted that while the final-stage payloads have been difficult to capture in testing environments, the ability of this zero-day to execute privileged commands and leak data is a significant threat. The discovery has put the global security community on high alert, as the sophisticated nature of the code suggests a highly capable threat actor is behind the campaign. Adobe users are urged to remain cautious of unsolicited attachments as the industry awaits a formal patch for this persistent vulnerability.