Attacks exploiting a design vulnerability in the Foxit PDF reader were launched by various threat actors to facilitate the delivery of several malicious payloads, including Agent Tesla, Remcos RAT, AsyncRAT, and XWorm, among others, reports The Hacker News. Intrusions linked to suspected Indian state-sponsored threat operation DoNot Team, also known as Origami Elephant and APT-C-35, involved the distribution of a military-themed PDF document that facilitates the retrieval of a pair of executables and a downloader for another payload when opened using Foxit, a report from Check Point revealed.

Source: SC Magazine