Attackers have been leveraging a previously unknown vulnerability in Adobe Reader through malicious PDFs, with activity dating back to at least December.

Security researcher Haifei Li (creator of EXPMON, a platform for detecting exploits using sandboxing) reported these attacks, noting on Tuesday that the attackers employ a “highly sophisticated, fingerprinting-style PDF exploit” targeting a secret Adobe Reader security weakness.

Li also stated that these attacks, targeting Adobe users for at least 4 months, involve stealing data from infected systems using privileged Acrobat APIs (util.readFileIntoStream and RSS.addFeed) and deploying further exploits.

“This ‘fingerprinting’ exploit has been confirmed to leverage a zero-day/unpatched vulnerability that works on the latest version of Adobe Reader without requiring any user interaction beyond opening a PDF file,” Li warned.

“More alarmingly, the exploit enables the attacker to gather/steal local information and potentially initiate RCE/SBX (Remote Code Execution/Sandbox Escape) attacks, potentially gaining complete control over the victim’s computer.”

Haifei Li has a track record of discovering security flaws in software from Microsoft, Google, and Adobe, many of which have been actively exploited as zero-days.

Threat intelligence analyst Gi7w0rm also examined the Adobe Reader exploit and discovered that the PDF documents used in these attacks contain lures in Russian referencing current events in the Russian oil and gas sector.

Li has informed Adobe of his findings. Until Adobe releases a security update to fix this actively exploited flaw, he advises Adobe Reader users to avoid opening PDF documents from unknown sources.

To defend against attacks exploiting this zero-day, network administrators can monitor and block HTTP/HTTPS traffic that includes “Adobe Synchronizer” in the User-Agent header.

“This zero-day/unpatched capability for broad information harvesting and the potential for subsequent RCE/SBX exploitation is enough for the security community to remain on high alert. This is why we have chosen to publish these findings immediately so users can stay vigilant,” he added.

BleepingComputer reached out to Adobe for comment on Li’s findings, but has not yet received a response.