Hackers are exploiting a design flaw in Foxit PDF Reader to deliver a range of malware, This vulnerability triggers security warnings that can mislead users into executing harmful commands.
The attack works by displaying a series of pop-up warnings to the user. The default option on these pop-ups is “OK,” which, if clicked, allows the malware to be downloaded and executed.
Security researchers believe that attackers are counting on users to simply click “OK” without reading the warnings carefully. This is a common tactic used in phishing attacks.
The issue arises because Foxit PDF Reader presents “OK” as the default option in a pop-up when users are prompted to trust the document before enabling certain features. If users click “OK,” a second pop-up warns them that the file is about to execute additional commands, with “Open” as the default choice. This action triggers the download and execution of a malicious payload.
What You Can Do
If you use Foxit PDF Reader, it is important to be aware of this flaw and to be careful about the links you click on when using the software. You should also update to the latest version of Foxit PDF Reader as soon as possible. The latest version 2024.3 is expected to fix this flaw.
