This month Adobe patched a critical use-after-free vulnerability in Adobe Flash Player that affects Windows 10, Mac, Chrome, and Linux operating systems. If exploited, an attacker can gain full control of an unpatched device.

Adobe reports that an exploit for the vulnerability – tracked as CVE-2018-4878 – has been identified and is being used in attacks on Windows 10 devices.

At the time that the patch was issued, only a limited number of attacks had been detected. However, researchers at Morphisec report the vulnerability is now being exploited in a massive spam email campaign that is targeting users in the United Kingdom and United States. While the spam campaign was relatively short-lived, large quantities of emails were sent and further spam campaigns can be expected.

The emails include a shortlink which, if clicked, downloads a Word document from a recently registered domain. Opening the document sees a command prompt opened that is injected with Shellcode that connects to the attackers’ C2. Once a connection is made, a DLL file is downloaded and executed using regsvr32. According to Morphisec this bypasses whitelisting solutions. A SWF Flash file is then extracted which also had a low detection rate and the vulnerability is exploited.

What makes the attack particularly dangerous is the poor detection rate by AV solutions. In a recent blog post Morphisec said in its tests, only 1/67 AV firms on VirusTotal identified the email attachment as malicious.

The shortened goo.gl URLs used in the emails are difficult to detect as malicious and look similar to those used in legitimate email campaigns. The number of links being opened also corresponds with standard email campaigns, with high numbers of clickthroughs as the emails hit inboxes. The figures show that many email recipients have been fooled by the campaign.

This email campaign shows why it is so important for patches to be applied promptly, especially when there are active exploits for a vulnerability in the wild. This is just one campaign, and there are likely to be many conducted using the Flash exploit.

However, despite the risks from slow patching, many companies take weeks, months, or in some cases years before patches are applied, leaving them extremely vulnerable to attack.