Adobe has confirmed a zero-day flaw in its Acrobat and Reader products is actively being exploited.
According to a blog post by Symantec researcher Joji Hamada, the attack comes via a PDF loaded with Trojan.Pidief.H, sent as an email attachment.
"The attack attempts to lure email recipients into opening the attachment," he noted. "When the file is opened, a malicious file is dropped and run on a fully patched system with either Adobe Reader or Acrobat installed."
Adobe confirmed the report on its blog, noting it was reported to it yesterday. "We are currently investigating this issue and assessing the risk to our customers," Adobe said. "We will provide an update as soon as we have more information."
Symantec's Hamada added: "In the meantime, I recommend everyone to be extra vigilant during this holiday season, especially when receiving emails from an unknown person."
If that sounds scary, don't panic. Symantec said the rate of infection is "extremely limited" and the risk level is "very low."
Adobe products have been hit by a series of attacks this year, and the firm has followed Microsoft's lead and rolled out its own regular patching update.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
The threat prevention buyer's guideWhitepaper Find the best advanced and file-based threat protection solution for you
-
Supply chain as kill chainWhitepaper Security in the era Zero Trust
-
Microsoft under fire for “negligent” security practices in scathing critique by industry execNews Microsoft took more than 90 days to issue a partial fix for a critical Azure vulnerability, researchers found
-
Apple patches zero day linked to spyware campaignNews Kaspersky researchers were the first to report a zero day used in a sophisticated attack chain
-
Warning issued over “incomplete” fix for Adobe ColdFusion vulnerabilityNews An incomplete fix for a vulnerability disclosure could be placing users at risk, researchers warned
-
MOVEit cyber attack: Cl0p sparks speculation that it’s lost control of hackNews The hackers return with their second major data-extortion attack of 2023, but may have bitten off more than they can chew
-
Microsoft says it knows who was behind cyber attacks on MOVEit TransferDozens of organizations may have already lost data to hackers exploiting the critical flaw
-
Trend Micro security predictions for 2023Whitepaper Prioritise cyber security strategies on capabilities rather than costs
