Adobe has confirmed a zero-day flaw in its Acrobat and Reader products is actively being exploited.
According to a blog post by Symantec researcher Joji Hamada, the attack comes via a PDF loaded with Trojan.Pidief.H, sent as an email attachment.
"The attack attempts to lure email recipients into opening the attachment," he noted. "When the file is opened, a malicious file is dropped and run on a fully patched system with either Adobe Reader or Acrobat installed."
Adobe confirmed the report on its blog, noting it was reported to it yesterday. "We are currently investigating this issue and assessing the risk to our customers," Adobe said. "We will provide an update as soon as we have more information."
Symantec's Hamada added: "In the meantime, I recommend everyone to be extra vigilant during this holiday season, especially when receiving emails from an unknown person."
If that sounds scary, don't panic. Symantec said the rate of infection is "extremely limited" and the risk level is "very low."
Adobe products have been hit by a series of attacks this year, and the firm has followed Microsoft's lead and rolled out its own regular patching update.
