Threat actors have been actively exploiting a highly sophisticated, previously unknown zero-day vulnerability in Adobe Reader since at least December 2025, using socially engineered PDF lures (like “Invoice540.pdf”) to entice victims into opening malicious files. These PDFs execute obfuscated JavaScript upon opening (requiring no further user interaction) and abuse unpatched functionality to invoke privileged Acrobat APIs (including util.readFileIntoStream and RSS.addFeed), enabling extensive local data harvesting, system fingerprinting, and exfiltration to attacker-controlled infrastructure. The campaign, identified by EXPMON researcher Haifei Li, has been observed targeting users for months and is confirmed to work against fully updated Adobe Reader versions, significantly elevating its risk profile. The exploit operates as a multi-stage framework capable of retrieving additional payloads and facilitating follow-on activity, including potential remote code execution (RCE) and sandbox escape (SBX), which could ultimately grant full system control. Analysis also reveals the use of Russian-language phishing lures tied to oil and gas sector events, indicating targeted social engineering. With the final payload conditions still unclear and no patch currently available, defenders are advised to monitor for indicators such as “Adobe Synchronizer” in HTTP/HTTPS User-Agent strings and restrict untrusted PDF execution, as the campaign represents a high-confidence, actively exploited threat requiring immediate vigilance.