Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal

**Executive summary**: Multiple threat actors, including the DoNot Team (APT-C-35), are exploiting a Foxit PDF Reader design flaw that uses misleading default 'OK/Open' dialogs to execute commands and download malware (RATs, stealers, miners); campaigns leverage Discord CDN, GitLab, Trello and social platforms to deliver weaponized PDFs for espionage, credential theft and crypto‑mining, and Foxit plans a fix in version 2024.3.