Hackers Actively Attacking Adobe Reader Users Using Sophisticated 0

Cybersecuritynews •Abinaya • April 8, 2026

A highly sophisticated, unpatched zero-day exploit is actively targeting users of Adobe Reader. Detected by the EXPMON threat-hunting system, this malicious PDF file is designed to steal sensitive local data and perform advanced system fingerprinting. The exploit functions flawlessly on the latest version of Adobe Reader. It requires no user interaction beyond simply opening the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Zero-Day Exploit Targeting Adobe Reader Users A zero-day vulnerability in Adobe Reader has been actively exploited since at least December 2025, allowing attackers to execute remote code and steal sensitive data through malicious PDF files. Security researcher Haifei Li identified the exploit, which does not require user interaction beyond opening a PDF document. The exploit leverages a memory corruption flaw and utilizes sophisticated techniques to evade detection, including in-memory execution and obfuscation. Attackers have been observed using Russian-language lures related to the oil and gas industry to target victims. The vulnerability affects the latest version of Adobe Reader, and organizations are advised to refrain from opening untrusted PDF files until a patch is released. Adobe has been notified of the issue, but no patch has been issued as of the latest reports. The exploit's sophistication suggests potential involvement from well-resourced threat actors, possibly nation-state linked. 49 sources 76

Hackers Actively Attacking Adobe Reader Users Using Sophisticated 0

The full story

Extracted Entities

Attack Types (2)

Platforms (1)