Hackers Exploit SimpleHelp Flaw to Deploy TaskWeaver and Djinn Stealer

Summary

Blackpoint reports attackers exploited SimpleHelp flaw CVE-2026-48558 to deploy TaskWeaver and Djinn Stealer. The cross-platform stealer targets developer, cloud, AI-tool and cryptocurrency credentials; administrators should patch and rotate credentials.

Key points

CVE-2026-48558 reportedly lets attackers create privileged SimpleHelp technician accounts without authentication on servers using OIDC.
Blackpoint investigated an intrusion involving an internet-facing SimpleHelp server, where attackers used the access to deploy TaskWeaver and Djinn Stealer.
TaskWeaver is described as a loader that fingerprints devices and receives JavaScript modules from command-and-control infrastructure.
Djinn Stealer targets credentials and data used by developers and infrastructure teams, including cloud accounts, source-control tools, package registries, AI assistants and cryptocurrency wallets.
The malware reportedly archives collected data, compresses it with GZIP and encrypts it with AES-256-GCM before exfiltration.
Blackpoint recommends updating SimpleHelp, invalidating unrecognized technician sessions, and rotating credentials and API keys if a system was breached.

Article Details

Event Type: Active exploitation of the SimpleHelp vulnerability CVE-2026-48558 to create privileged technician access and deploy the TaskWeaver loader and Djinn Stealer.
Impact: The malware targets developer and infrastructure credentials, cloud accounts, AI development tooling, cryptocurrency wallets, and other sensitive data across Windows, macOS, and Linux. Stolen credentials could provide access to repositories, cloud resources, databases, and APIs. The article recommends patching SimpleHelp, invalidating unrecognized technician sessions, and rotating credentials and API keys.