Loading story…
Attackers are actively exploiting CVE-2026-48558, a critical OIDC authentication bypass in the SimpleHelp remote monitoring and management platform, to gain technician-level access to internet-facing servers without valid credentials. Investigators found the intrusions used the trusted RMM channel to deploy TaskWeaver, a heavily obfuscated JavaScript/Node.js loader that established encrypted communications with attacker infrastructure and fetched a second-stage payload known as Djinn Stealer. Blackpoint Cyber said its disclosure of active exploitation prompted CISA to add the flaw to the Known Exploited Vulnerabilities catalog.
Once deployed, Djinn Stealer harvested high-value secrets from Windows, macOS, and Linux systems, including cloud credentials, SSH keys, API keys, service account credentials, browser data, source-control and package-registry tokens, cryptocurrency wallets, and credentials tied to AI development tools. Researchers said the malware encrypted stolen data with AES-256-GCM and protected the encryption key with RSA-2048 before exfiltration, while the campaign appeared to rely on opportunistic scanning for exposed vulnerable SimpleHelp instances rather than tightly targeted victim selection. The activity raises particular concern for MSPs and enterprises because a compromise of trusted RMM infrastructure can extend quickly into cloud, CI/CD, and software supply chain environments.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Following Blackpoint's disclosure of active exploitation, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog. The move underscored the need for affected organizations, especially MSPs, to patch, investigate, and rotate potentially exposed credentials.
Blackpoint Cyber publicly reported its investigation into the intrusion chain involving SimpleHelp exploitation, TaskWeaver, and Djinn Stealer. The disclosure highlighted the risk that compromise of trusted RMM infrastructure could extend into enterprise, cloud, CI/CD, and software supply chain environments.
TaskWeaver retrieved and deployed Djinn Stealer, a cross-platform information stealer affecting Windows, macOS, and Linux systems. The malware targeted cloud credentials, SSH keys, API and service account credentials, package registry and source control tokens, browser data, cryptocurrency wallets, and AI development tool secrets, encrypting stolen data before exfiltration.
After obtaining access through the vulnerable SimpleHelp platform, the attacker deployed an obfuscated Node.js/JavaScript loader tracked as TaskWeaver. The loader established encrypted communications with attacker infrastructure and served as a reusable second-stage delivery mechanism.
A recent intrusion campaign used CVE-2026-48558, a critical SimpleHelp OIDC authentication bypass, to gain technician-level access on Internet-facing remote monitoring and management servers without valid credentials. Researchers said the activity appeared to involve opportunistic scanning for vulnerable exposed instances.
SimpleHelp fixed the critical CVE-2026-48558 OpenID Connect authentication bypass on 2026-06-09, releasing versions 5.5.16 and 6.0 RC2. The flaw allowed unauthenticated attackers to forge identity tokens and create privileged Technician accounts, with possible MFA bypass in some configurations.
SimpleHelp published a security notice saying servers running 5.5.15 and earlier may be vulnerable under certain conditions and urged customers to update immediately. The company provided fixed releases 5.5.16 and 6.0 RC2, along with installation guidance and package hashes, while saying fuller disclosure details would follow later.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcethreataft.com
Open sourceblackpointcyber.com
Open sourcedarkreading.com
Open sourcethreataft.com
Open sourcesimple-help.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-48558**, a maximum-severity authentication bypass in **SimpleHelp** RMM, to forge OpenID Connect identity tokens and obtain fully authenticated **technician sessions** on exposed servers. The flaw affects deployments using generic OIDC or Azure AD OIDC because SimpleHelp accepted identity tokens without validating their cryptographic signatures, enabling unauthenticated access and, in some cases, bypass of MFA during technician enrollment. The issue affects **SimpleHelp 5.5.1 through 5.5.15** and **6.0 pre-release builds before 6.0 RC2**, and has been patched in **5.5.16+** and **6.0 RC2+**. In observed intrusions, attackers abused the trusted RMM channel to transfer files and execute commands across managed endpoints, deploying the obfuscated **TaskWeaver** Node.js loader followed by the newly identified **Djinn Stealer** malware. Reporting says TaskWeaver fetched additional payloads and used encrypted communications, while Djinn Stealer harvested credentials and sensitive data from browsers, cloud platforms, developer and package registry tooling, SSH environments, AI tools, and cryptocurrency wallets across **Windows, macOS, and Linux** before exfiltration. **CISA** added the flaw to its **Known Exploited Vulnerabilities** catalog, and sector alerts warned that compromise of a SimpleHelp server could give attackers downstream access across MSP and utility environments, increasing the risk of lateral movement, credential theft, and ransomware deployment.
Jul 6, 2026
Researchers disclosed **CVE-2026-48558**, a maximum-severity authentication bypass in SimpleHelp remote management software that allows unauthenticated attackers to forge OpenID Connect identity tokens and log in as a technician. The flaw affects SimpleHelp `5.5.15` and earlier, along with `6.0` pre-release versions, because the OIDC login flow accepts submitted JWT identity tokens without verifying their cryptographic signature. The issue is rated `CVSS 10.0` and mapped to `CWE-347`, with no user interaction required for exploitation. Successful exploitation can give attackers an authenticated technician session with administrative reach into managed environments, including remote access to endpoints, script execution, and in some cases **MFA bypass** because technician accounts can enroll their own MFA method at first login. Horizon3.ai said the bug affects deployments using generic OIDC and Azure Active Directory OIDC, and estimated that internet-exposed SimpleHelp servers have grown to nearly **14,000**, with about **7.2%** using the vulnerable configuration. Defenders were urged to apply vendor patches immediately, restrict technician authentication by IP where patching is delayed, and review technician accounts and server logs for signs of compromise.
Jul 2, 2026
SimpleHelp released fixes for three **critical** vulnerabilities in its remote support and RMM software that can be chained to gain full control of vulnerable servers. The flaws are tracked as `CVE-2024-57726`, an authorization weakness that allows privilege escalation to administrator; `CVE-2024-57727`, an unauthenticated arbitrary file download issue that can expose sensitive data and credentials; and `CVE-2024-57728`, an authenticated administrator file upload flaw that can lead to remote code execution. Horizon3.ai disclosed the issues, and affected versions include SimpleHelp `5.5` before `5.5.8`, `5.4` before `5.4.10`, and `5.3` before `5.3.9`. CSIRT.SK reported that attackers have already targeted exposed SimpleHelp RMM systems, with Arctic Wolf observing intrusions in which threat actors used leaked credentials or exploited the vulnerabilities for initial access and compromise. The vendor urged organizations to patch immediately, rotate administrator and technician passwords, and restrict those account logins to trusted IP addresses to reduce the risk of server takeover and downstream compromise of managed endpoints.
Jul 24, 2026