Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025

A zero-day vulnerability in Adobe Reader has been actively exploited via malicious PDF files since at least December 2025.

• •The exploit artifact "Invoice540.pdf" was first detected on VirusTotal on November 28, 2025, with a second sample uploaded on March 23, 2026.
• •Upon opening, the PDF automatically executes obfuscated JavaScript to harvest sensitive data and download additional payloads.
• •The vulnerability enables execution of privileged Acrobat APIs and is confirmed to work on the latest version of Adobe Reader.
• •Collected data is exfiltrated to a remote server (169.40.2[.]68:45191), with potential for subsequent RCE and sandbox escape (SBX) exploits.
• •The PDF documents contain Russian-language lures referencing oil and gas industry events in Russia.