Adobe Systems is warning users about a serious vulnerability in its Flash Player that security researchers say was used to deliver the notorious FinSpy spyware.
The vulnerability, which can trigger remote code execution, only came to light when security firm Kaspersky Lab noticed it as part of a hacking attempt against a customer last week.
According to Kaspersky, a shadowy group designed an exploit around the Adobe Flash Player flaw that'll download and install FinSpy onto a victim's computer. The exploit itself was hidden in an Office document that was likely sent over email.
On Monday, Adobe released a security update, and said users can patch the vulnerability by downloading the Flash Player's latest version.
Fortunately, Kaspersky has only spotted one hacking attempt leveraging this vulnerability, which suggests the attacks have been few in number. However, the security firm is still urging businesses and government organizations to patch their systems.
FinSpy, also known as FinFisher, is infamous for being a surveillance software that's been sold to law enforcement groups and governments worldwide. Thirty-two countries have been suspected of using the spyware, according to a 2015 investigation from the University of Toronto's, Citizen Lab.
The security firm Kaspersky is blaming this particular attack on a mysterious group known as BlackOasis, which it says has been targeting bloggers, activists and figures involved in Middle Eastern politics.
In the past, BlackOasis has tried to hack victims by sending decoy Word documents laced with malicious code that'll secretly install FinSpy on a computer.
The group also has access to expert hacking knowledge. Since June 2015, BlackOasis has been found using five previously unknown vulnerabilities, or zero-days, to target victims, according to Kaspersky.
Each of these zero-day vulnerabilities are valuable, and can make defending against the group's hacks extra challenging.
To stay safe, security experts advise users to be careful around their email inbox. Hackers often try to trick their victims into opening an attachment, or visiting a link, as a way to install malware onto their computer.