SimpleHelp auth bypass exploited to deploy TaskWeaver and Djinn Stealer

CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog after active exploitation of a critical authentication bypass in the SimpleHelp remote monitoring and management platform. The flaw affects SimpleHelp’s OIDC authentication flow because identity tokens are accepted without cryptographic signature verification, allowing a remote unauthenticated attacker to forge tokens and obtain a fully authenticated technician session; in some deployments, the issue can also bypass MFA. CISA set a 2026-07-02 remediation deadline and directed organizations to apply vendor mitigations and follow BOD 26-04 guidance.

Blackpoint Cyber reported that attackers used the vulnerability on Internet-facing SimpleHelp servers to gain technician-level access and deploy an obfuscated Node.js loader called TaskWeaver, which then delivered Djinn Stealer. The malware harvested cloud credentials, SSH keys, API and service account secrets, source control and package registry tokens, browser data, cryptocurrency wallets, and credentials tied to AI development tools across Windows, macOS, and Linux systems. Researchers said the campaign appeared to rely on opportunistic scanning for exposed vulnerable instances, raising concern that compromise of trusted RMM infrastructure could cascade into broader enterprise, cloud, CI/CD, and software supply chain access.