Attackers target Adobe flaw as wait for patch continues

Malware writers are continuing to exploit a high-profile zero-day flaw in Adobe Acrobat and Reader, using a spam attack to spread the remote code execution vulnerability in the wild.

The attack arrives as an unsolicited financial report claiming to be from Barclay's Capital, according to security firm Sophos.

The attached PDF file launches the Reader and Acrobat attack, and specially crafted code within the file targets the vulnerability and attempts to download malware-serving Trojans.

"We have started seeing a small number of targeted samples in Sophos Labs of attackers trying to use this vulnerability in email attachments. The emails are well crafted and look very believable," Sophos senior security advisor Chester Wisniewski said in a blog post.

Adobe has been working to address the flaw with an out-of-cycle security fix scheduled to arrive some time in the coming week.

Microsoft is also scheduled to release its monthly security update in the coming days. The 13 December update is slated to deliver 14 bulletins covering 20 security flaws in Windows, Office and Internet Explorer.