Attackers Exploit Simple Help CVE-2026-48558 to Deploy Task Weaver and Djinn Stealer
Summary: An unknown threat actor exploited CVE-2026-48558, a CVSS 10.0 authentication bypass in SimpleHelp's OIDC flow that lets an unauthenticated attacker forge a token and obtain a fully authenticated Technician session, to deploy two previously unreported malware families, TaskWeaver and Djinn Stealer. TaskWeaver is an obfuscated Node.js loader delivered as jquery.js and run through node.exe that pulls additional JavaScript payloads from a.dev-tunnels[.]com, while Djinn Stealer harvests credentials for cloud platforms, source control, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets on Windows, macOS, and Linux, with data packed into a TAR archive, GZIP-compressed, encrypted with AES-256-GCM under an RSA-2048 key, and sent to 96.126.130[.]126:58942.
What you should know: Horizon3.ai's Zach Hanley noted the flaw also defeats MFA, because technicians can self-register their own MFA method on first login, and CISA's KEV listing gives FCEB agencies until July 2, 2026 to patch. As the researchers put it, a single authentication bypass became a pathway into everything the managed systems could reach, and credentials taken from one developer or administrator workstation can open production infrastructure, build pipelines, and customer environments long after the original endpoint has been contained.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-48558
- Related
- CVE-2026-48558: Simple Help Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jun 29, 2026⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026