Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer

An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

The article reports that threat actors are exploiting CVE-2026-48558, a critical authentication bypass in SimpleHelp’s OIDC flow (CVSS 10.0), to gain technician-level remote access and deploy new malware families TaskWeaver and Djinn Stealer on managed endpoints.[1][3][8] Djinn Stealer is described in other research as a cross‑platform infostealer that harvests credentials from cloud platforms, source control, infrastructure tooling, and AI development assistants, indicating direct impact on developer and AI tool ecosystems.[3][8] From a CyberSE.AI perspective, this represents an AI supply chain risk: compromise of RMM infrastructure and developer systems can expose AI models, assistants, secrets, and code, so organizations should patch SimpleHelp, restrict access to admin interfaces, rotate credentials and OIDC secrets, and perform targeted forensic review of systems running AI tooling. Mapping these controls into SBOM-driven asset inventories and AI-tool-specific monitoring will help identify where compromised endpoints intersect with AI development environments and reduce downstream model and data exposure.