Hackers Actively Attacking Adobe Reader Users Using Sophisticated 0-Day Exploit

A zero-day Adobe Reader vulnerability is actively exploited via a crafted PDF that uses embedded/obfuscated JavaScript to bypass sandboxing (util.readFileIntoStream) and exfiltrate local files to attacker infrastructure (noted IP 169.40.2.68:45191), perform advanced system fingerprinting, and dynamically retrieve encrypted secondary payloads capable of RCE and sandbox escape; defenders are advised to block the reported IP, monitor for the "Adobe Synchronizer" User-Agent, and avoid opening untrusted PDFs.