Adobe Reader users beware experts flag months-old security flaw using booby-trapped PDFs to scope out victims

Date:
Fri, 10 Apr 2026 13:25:00 +0000

Description:
Adobe Reader contains a zero-day that has been abused for some time, experts warn.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Experts find Adobe Reader hit by dangerous zeroday exploit Malicious PDFs enable data theft and possible full takeover Patch pending, users urged to avoid untrusted files Adobe Reader users have been warned to be careful with unsolicited documents coming in via email and social channels, as the popular PDF reader is vulnerable to a zero-day flaw whicht allows hackers to steal sensitive files and, in some scenarios, to
even fully take over your device.

Security researcher Haifei Li found a highly sophisticated, fingerprinting-style PDF exploit being leveraged in the wild since December 2025, with attacks still currently ongoing. "This 'fingerprinting' exploit
has been confirmed to leverage a zero-day/unpatched vulnerability that works on the latest version of Adobe Reader without requiring any user interaction beyond opening a PDF file," Li said. "Even more concerning, this exploit allows the threat actor to not only collect/steal local information but also potentially launch subsequent RCE/SBX attacks, which could lead to full control of the victim's system." Article continues below You may like Still using WinRAR? You should probably look out for these potentially dangerous security flaws Worrying Microsoft Office security flaw patched - update now
or risk hackers accessing your files Russian hackers are targeting a new Office 365 zero-day, so patch now or face attack Targeting Russians A
separate report from an analyst with the alias Gi7w0rm says that the PDF lure being used in these attacks references ongoing events in the Russian oil and gas industry, and that it was written in Russian, suggesting who the targets might be.

Adobe is yet to release a patch to address this issue, and until that happens all Adobe Reader users are advised not to open PDF documents from untrusted contacts.

BleepingComputer notes network defenders can also mitigate attacks
exploiting this vulnerability by monitoring and blocking HTTP/HTTPS traffic with the Adobe Synchronizer string in the User-Agent header.

"This zero-day/unpatched capability for broad information harvesting and the potential for subsequent RCE/SBX exploitation is enough for the security community to remain on high alert. This is why we have chosen to publish
these findings immediately so users can stay vigilant," the researcher concluded. Are you a pro? Subscribe to our newsletter Sign up to the
TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/adobe-reader-users-beware-experts-flag- months-old-security-flaw-using-booby-trapped-pdfs-to-scope-out-victims


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)