A sophisticated, previously unknown vulnerability in Adobe Reader has been discovered and is currently being exploited in the wild using specially crafted PDF documents. Uncovered by security researcher Haifei Li and the EXPMON platform, this attack represents a new breed of file-based threat that blends exploit execution with covert reconnaissance and selective payload delivery.
Rather than relying on traditional malware distribution, this campaign focuses on data collection, environment profiling, and targeted follow-on attacks — making it considerably harder to detect and contain.
Available evidence suggests the campaign has been running since at least late 2025 and continues to compromise fully patched systems, confirming the use of a previously undisclosed, unpatched vulnerability.
How the Attack Begins: Malicious PDF Lures
The infection starts with a social engineering tactic — typically a convincing PDF disguised as something routine, like an invoice. The victim doesn’t need to do much; simply opening the file is enough to trigger the exploit chain.
Upon opening, obfuscated JavaScript embedded within the PDF executes inside Acrobat’s scripting engine. The script is concealed using Base64 encoding and hidden object structures to slip past static detection tools.
This marks a notable departure from macro-based attack methods, instead exploiting trusted document-handling workflows native to PDF applications.
How the Exploit Works: Hijacking Privileged Acrobat APIs
At the heart of this attack is a zero-day flaw that grants unauthorized access to privileged Acrobat APIs. Two functions are particularly central to the abuse:
- util.readFileIntoStream() — used to read arbitrary files directly from the victim’s machine
- RSS.addFeed() — repurposed as a covert channel to send harvested data to attacker-controlled servers
While neither function is inherently dangerous, combining them with the underlying vulnerability allows attackers to bypass sandbox protections and access the file system — all without dropping a single traditional malware file.
Intelligent Targeting: Profiling Victims Before Striking
One of the campaign’s most distinctive features is its conditional, intelligence-driven execution model. After the initial data collection phase, the malware:
- Profiles the operating system and host environment
- Harvests locally accessible data
- Evaluates the system’s characteristics and behavior
This profile is then sent to a remote server, where attackers decide whether the target is worth pursuing further. If it qualifies, the server sends back additional encrypted JavaScript payloads, customized for that specific environment.
This selective delivery approach keeps the campaign’s footprint small and limits exposure to only high-value targets.
What Comes Next: Remote Execution and Sandbox Escape
Though the early stages focus on reconnaissance and exfiltration, the framework is clearly designed to support deeper compromise. Observed and potential capabilities include:
- Remote Code Execution (RCE)
- Sandbox Escape (SBX)
- Dynamic payload staging via injected remote scripts
The PDF essentially functions as a loader and decision-making engine — not a straightforward payload carrier. The fact that second-stage payloads aren’t always deployed suggests deliberate environment-aware gating to avoid triggering analysis systems.
Evading Detection: Why This Attack Is So Hard to Catch
This campaign layers multiple evasion strategies on top of one another:
- Low antivirus detection rates at the time of initial submission
- Heavy JavaScript obfuscation and encoding
- Exclusive use of legitimate application APIs, avoiding suspicious system-level calls
- No binary payload dropped during early stages, eliminating common detection triggers
Because the exploit runs entirely within a trusted application, it blends seamlessly into normal user behavior, making behavioral detection significantly more challenging. EXPMON identified the threat through exploit-centric analysis — underscoring the shortcomings of conventional, signature-based detection approaches.
Command Infrastructure and Data Exfiltration
The exploit maintains contact with remote attacker infrastructure to transmit harvested victim data, receive secondary payloads, and coordinate execution. Indicators include outbound connections to attacker-controlled servers and custom communication logic embedded directly in JavaScript.
In some observed cases, the absence of payload delivery points to server-side victim filtering — further supporting the theory that targets are hand-selected based on their profiles.
Broader Implications for the Security Landscape
This campaign signals several meaningful shifts in how advanced threats operate:
- Exploit-First Strategy — Attackers are prioritizing vulnerability abuse over malware deployment, leaving fewer detectable traces behind.
- PDFs as Active Exploit Containers — Documents are no longer passive carriers; they now serve as multi-stage attack platforms in their own right.
- Real-Time Adaptive Targeting — Campaigns are increasingly incorporating live decision logic to minimize exposure and maximize efficiency.
- Failures of Traditional Security Models — Signature-based antivirus and many sandboxing tools fall short when no executable is dropped, execution is environment-dependent, and legitimate APIs are abused.
How to Defend Against This Class of Attack
Organizations should approach this threat as a file-borne exploit framework rather than conventional malware. Recommended mitigations include:
- Disabling or restricting JavaScript execution within Adobe Acrobat where possible
- Monitoring for unusual Acrobat API activity and abnormal file access patterns
- Inspecting outbound network traffic for suspicious PDF-triggered communications
- Deploying Content Disarm and Reconstruction (CDR) pipelines for all inbound documents
- Shifting toward exploit-focused detection models rather than purely malware-centric ones
Conclusion
This Adobe Reader zero-day represents a significant leap forward in document-based attack sophistication — merging exploit execution, covert data harvesting, and adaptive payload delivery into one tightly coordinated chain.
By weaponizing trusted file formats and legitimate application functionality, attackers are successfully bypassing conventional security boundaries, pushing the defensive frontier toward pre-execution inspection and exploit-level detection.
The takeaway is clear: files themselves must now be treated as active attack surfaces. FileDNA addresses this challenge head-on by approaching every incoming file — whether a Microsoft Office document or an Adobe PDF — as a potential threat. Through deep structural analysis and recursive, object-level inspection, FileDNA examines file composition and validates internal components to uncover hidden or suspicious content. Rather than waiting for execution or relying on known signatures, it neutralizes risks by cleaning or removing high-risk elements before the file ever reaches the end user — providing safe, reconstructed documents even against novel, unknown threats.