Multiple Threat Actors Exploit Foxit PDF Reader Flaw to Spread Malware

Multiple threat actors are exploiting a design flaw in Foxit PDF Reader to spread various malware, such as Agent Tesla, AsyncRAT, and Remcos RAT. According to Check Point, the flaw misleads users into executing harmful commands by displaying deceptive pop-ups with default "OK" and "Open" options. Malicious payloads are often hosted on Discord's content delivery network (CDN), contributing to the campaign's low detection rate. Notably, Adobe Acrobat Reader, more common in sandboxes or antivirus solutions, is not susceptible to this exploit. This flaw is exploited by a range of actors from e-crime to espionage, including the DoNot Team. Malicious PDFs have been distributed through platforms like Facebook and Trello. Check Point identified several instances where the attack chain involved downloading additional malware, such as credential stealers and cryptocurrency miners, from repositories like Gitlab.