Hackers Exploit Adobe PDF Flaw for Months to Steal Data, No Fix Yet

Attackers have been exploiting a zero-day in Adobe Acrobat Reader via specially crafted PDFs that trigger on open to extract local files, fingerprint victim environments, and enable follow-on remote code execution and sandbox escape. The targeted campaign—active for months—used Russian-language lures tied to the oil and gas sector; Adobe had not released a patch at publication, and mitigations recommended include disabling JavaScript, using isolation, enforcing least privilege, and monitoring for suspicious Adobe API/network activity.