Granted Without Asking: How CVE-2026-48558 Lets TaskWeaver and Djinn Stealer Walk in the Front Door
A maximum-severity authentication bypass in SimpleHelp's OIDC flow, CVE-2026-48558, is being actively exploited to hijack technician sessions, even past MFA. Attackers use this access to deploy TaskWeaver, a stealth Node.js loader disguised as jQuery, then Djinn Stealer, which harvests cloud, developer, AI-assistant, and crypto-wallet credentials. Now in CISA's KEV catalog with a CVSS of 10.0, this is an urgent, assume-compromise scenario for any SimpleHelp OIDC deployment.
Summary
An unknown threat actor has been observed exploiting CVE-2026-48558, a maximum-severity authentication bypass in SimpleHelp Remote Monitoring and Management (RMM) software, to deliver two previously undocumented malware families: TaskWeaver, a heavily obfuscated Node.js loader, and Djinn Stealer, a cross-platform credential harvester. The vulnerability, which carries a CVSS score of 10.0, allows an unauthenticated attacker to forge an identity token and obtain a fully privileged "Technician" session, even on servers configured to enforce multi-factor authentication.
What makes this intrusion notable isn't just the authentication bypass itself, but what happened after it. The compromised RMM platform gave the operator a trusted administrative channel to transfer files and execute commands across every endpoint the server managed. From there, TaskWeaver established a reusable, encrypted payload-delivery channel, and Djinn Stealer was used to systematically strip infected machines of credentials spanning cloud infrastructure, source control, package registries, AI development assistants, browsers, SSH, and cryptocurrency wallets, turning a single unpatched appliance into a pathway toward dozens of downstream environments.
Background of TaskWeaver and Djinn Stealer
The intrusion chain was first documented by a group of researchers, who investigated and contained an incident that began with exploitation of CVE-2026-48558 against an internet-facing SimpleHelp server. Details of the underlying vulnerability were disclosed earlier in June 2026, it was identified that the flaw stems from how SimpleHelp validates identity provider (IdP) assertions in deployments using generic OIDC or Azure AD OIDC authentication.
On analysis, the group of researchers named the two malware families it recovered from the intrusion TaskWeaver and Djinn Stealer. TaskWeaver was delivered under the filename jquery.js — a deliberate attempt to masquerade as the legitimate jQuery library and executed through the Node.js runtime. Djinn Stealer, recovered as a second-stage payload delivered by TaskWeaver, reuses the same obfuscation framework and embeds an identical RSA public key, directly linking the two tools to a single operator.
Djinn Stealer's collection rules go well beyond conventional browser credential theft, it specifically targets configuration, authentication, session, and project data for AI development assistants including Claude, Gemini, Codex, Cline, OpenCode, and Kilo. Because many of these tools use the Model Context Protocol (MCP) to connect to repositories, databases, and cloud accounts, stolen MCP tokens can hand an attacker the same downstream access a developer granted to their AI agent.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Vulnerability Type |
|---|---|---|---|
| CVE-2026-48558 | 10.0 (Critical) | 0.72% | Authentication Bypass (missing OIDC JWT signature verification) |
The flaw affects SimpleHelp deployments where OIDC-based technician authentication is enabled, specifically version 5.5.15 and prior, along with 6.0 pre-release builds. Because the server does not properly verify the signature on incoming identity tokens, an attacker anywhere on the internet can craft a token asserting any identity and be granted a live technician session, no credentials, phishing, or social engineering required. Standing technician permissions typically include remote endpoint access, script execution, and file transfer, giving the attacker an administrative foothold the moment the forged token is accepted.
Attack Methodology
Djinn Stealer's collection scope is unusually broad for a commodity stealer. It targets Cloud platforms, Developer and deployment tooling, and Package registries and build tools, AI development assistants and Cryptocurrency wallets.
Indicators of Compromise (IOCs)
File Indicators
| Malware | Filename | SHA-256 |
|---|---|---|
| TaskWeaver | jquery.js | 00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c |
| Djinn Stealer | upload | f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc |
Network Indicators
| Type | Indicator |
|---|---|
| Loader staging | *.trycloudflare[.]com |
| TaskWeaver C2 | a[.]dev-tunnels[.]com |
| TaskWeaver URI pattern | POST /api/<base64url>.<base64url>.<base64url> |
| Djinn Stealer exfiltration | 96.126.130[.]126:58942 |
| Djinn Stealer User-Agent | telemetry-client/1.0 |
Host and Behavioral Indicators
| Type | Indicator |
|---|---|
| Execution command | node.exe <path>\jquery.js |
| TaskWeaver filename | jquery.js |
| Djinn Stealer filename | upload |
| Reconnaissance artifact | processList.txt |
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1078 | Valid Accounts (forged technician session) | Initial Access |
| T1219 | Remote Access Software | Command-And-Control |
| T1059.007 | JavaScript | Execution |
| T1027 | Obfuscated Files or Information | Stealth |
| T1036 | Masquerading (jquery.js filename) | Stealth |
| T1552 | Unsecured Credentials | Credential Access |
Visual Attack Flow
Mitigation
- Patch and restrict SimpleHelp immediately. Upgrade to version 5.5.16 or 6.0 RC2 or above, and remove technician interfaces from direct internet exposure until remediation is verified.
- Review authentication and session logs. Check OIDC configuration, technician-creation, session, file-transfer, and command-execution logs for unfamiliar accounts, anomalous IP addresses, unusual login times, or administrative activity without a corresponding support ticket.
- Terminate sessions and rotate exposed secrets. Invalidate active technician sessions and rotate credentials, API keys, integration secrets, and IdP configuration tied to the SimpleHelp server.
- Treat RMM platforms as privileged infrastructure. Place administrative interfaces behind a VPN or identity-aware proxy, enforce phishing-resistant MFA, and restrict access to dedicated administrative workstations.
- Alert on RMM-spawned scripting runtimes. Flag and investigate any instance of a remote-support tool launching Node.js, PowerShell, Python, Deno, or Bun, particularly from temporary, download, or user-writable directories.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
