Critical SimpleHelp Auth Bypass Exploited for Djinn Stealer

In June 2026, researchers identified active exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in the SimpleHelp Remote Monitoring and Management (RMM) platform. This vulnerability allows remote, unauthenticated attackers to forge OIDC identity tokens and obtain technician-level access to the server, bypassing multi-factor authentication (MFA) and gaining full control over managed endpoints. While no specific actor has been attributed, the campaign leverages typosquatted Microsoft infrastructure to mask C2 traffic.

The attack chain involves the deployment of 'TaskWeaver,' a heavily obfuscated Node.js loader, which subsequently delivers 'Djinn Stealer.' Djinn Stealer is a sophisticated, cross-platform malware designed to target highly sensitive data, specifically prioritizing AI development tools (via Model Context Protocol), cloud provider credentials, and package registries. This represents a significant shift in adversary tradecraft toward compromising the software supply chain and AI development pipelines.

This threat is particularly urgent for Managed Service Providers (MSPs) and enterprises using SimpleHelp, as a single compromised management server can expose all downstream client environments. Organizations are advised to patch SimpleHelp versions 5.5.15 and prior immediately and rotate all credentials stored on potentially compromised administrator or developer workstations.