Months-old Adobe Reader zero-day uses PDFs to size up targets

Researchers reported a months-long, in-the-wild zero-day exploit against Adobe Acrobat Reader where booby-trapped PDFs run obfuscated JavaScript on open to profile systems, exfiltrate system and file information, and selectively fetch a second-stage payload that may achieve remote code execution or sandbox escape; lure documents suggest targeting related to Russian oil and gas, and no CVE or patch had been released at the time of reporting.