Infostealer Disguised as Adobe Reader Installer

AhnLab SEcurity intelligence Center (ASEC) recently discovered the distribution of an infostealer disguised as the Adobe Reader installer. The threat actor is distributing the file as PDF, prompting users to download and run the file.

As shown in the Figure 1, the fake PDF file is written in Portuguese, and the message tells the users to download the Adobe Reader and install it. By telling the users that Adobe Reader is required to open the file, it prompts the user …

actor adobe adobe reader ahnlab asec center disguised distribution download fake file infostealer installer intelligence malware analysis message pdf reader run security security intelligence threat threat actor written