MalwareExploits 1 CVE

TaskWeaver

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-48558SimpleHelp OIDC Authentication BypassExploited in the wild

Hackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer... Horizon3.ai published details about CVE-2026-48558, saying that the flaw could be leveraged to create highly privileged technician accounts without authentication. Exploiting the vulnerability is possible on servers using the OpenID Connect (OIDC) authentication protocol. | a threat actor exploited the critical authentication bypass vulnerability to establish an authenticated technician session on an internet-facing SimpleHelp server before deploying the TaskWeaver malware loader and the Djinn Stealer.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server

Execution

1 technique

T1059.007JavaScriptEvidence1

The investigation revealed that TaskWeaver was downloaded in the form of an obfuscated JavaScript file named ‘jquery.js’ from a temporary Cloudflare domain.

Persistence

1 technique

T1078Valid AccountsEvidence1

The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

a threat actor exploited the critical authentication bypass vulnerability to establish an authenticated technician session on an internet-facing SimpleHelp server

T1078Valid AccountsEvidence1

The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

TaskWeaver was downloaded in the form of an obfuscated JavaScript file named ‘jquery.js’

T1078Valid AccountsEvidence1

The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server

Discovery

1 technique

T1082System Information DiscoveryEvidence1

TaskWeaver is a generic malware loader that fingerprints the compromised device

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The compromised RMM platform provided the operator with a trusted administrative channel capable of transferring files and executing commands on systems managed through the server

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Jun 29, 2026

Critical SimpleHelp flaw exploited to deploy new stealer malware

A newly documented generic malware loader delivered as an obfuscated JavaScript file named 'jquery.js'. It fingerprints the compromised device, communicates with C2 infrastructure to receive additional JavaScript modules for execution, and installs Djinn Stealer. It also contains the embedded RSA public key used to protect the AES key for Djinn Stealer's encrypted exfiltration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.