Acrobat Reader zero-day exploited in the wild for many months

A zero-day Adobe Acrobat Reader vulnerability is being actively exploited via malicious PDF files that execute obfuscated JavaScript to fingerprint victims and fetch additional remote code execution/sandbox escape payloads. Samples submitted to EXPMON and VirusTotal indicate exploitation since at least November 28, 2025; researcher analysis identifies two attacker-controlled IPs (169.40.2.68 and 188.214.34.20), Russian-language decoys suggesting targeting of Russian-speaking infrastructure, and recommended mitigations while Adobe has not yet patched the issue.