Angler exploit kit goes after new Adobe Flash 0-day flaw

An exploit for a still officially unconfirmed zero-day vulnerability in Adobe Flash Player has been added to the popular Angler exploit kit and is, along with exploits for several other Flash flaws, opening users’ Windows machines to the Bedep trojan.

The discovery was made by malware researcher Kafeine, who says that not all instances of the exploit kit are equipped with an exploit for the zero-day.

Adobe Flash Player is so widely used that this particular malware delivery campaign could be very successful.

According to Kafeine, Windows 8.1 and Google Chrome users are safe from this exploit due to the operating system’s and browser’s sandbox. Malwarebytes Anti Exploit also blocks the exploit.

Windows XP, 7, 8 and Internet Explorer 6, 7, 8, and 10 users might want to consider disabling their Flash Player for a couple of days. The flaw affects Flash versions 16.0.0.235 and 16.0.0.257 (the latest).

The Bedep trojan makes the victims’ computer perform ad fraud calls.

Trend Micro researchers believe that malvertisements are being used to deliver these exploits to end users.

They have confirmed that the current version of Adobe Flash Player is affected, and that the Flash file carrying the exploit is heavily obfuscated.