Multiple outlets report that attackers exploit CVE-2026-48558, a recently disclosed and patched authentication bypass vulnerability in the SimpleHelp remote monitoring and management (RMM) platform, to deliver malware to compromised systems. Bleeping Computer and Help Net Security both describe Djinn Stealer being deployed as a cross-platform payload targeting Windows, macOS, and Linux. Infosecurity Magazine also links exploitation of the same SimpleHelp flaw to malware delivery, citing Djinn Stealer and additionally mentioning TaskWeaver.
According to Help Net Security, researchers attribute the activity to BlackPoint Cyber and describe Djinn Stealer as an information stealer that collects credentials and related data associated with multiple environments and tools. Reported targets include cloud platforms, source control systems, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets.
All accounts tie the campaign to the same SimpleHelp vulnerability and characterize it as critical, with exploitation occurring shortly after disclosure and patching. None of the sources provide additional details on attacker attribution or the full scope of affected SimpleHelp deployments.
