Skip to content

Critical SimpleHelp Vulnerability Exploited For Malware Delivery

Chimera readability score 66 out of 100, Academic reading level.

A critical authentication bypass in SimpleHelp's remote monitoring and management (RMM) software has been exploited to deliver two previously unseen malware families, after attackers forged a login token to seize control of a managed network.
New analysis from security firm Blackpoint Cyber found that an attacker exploited the flaw, tracked as CVE-2026-48558, to obtain a trusted technician session on an internet-facing SimpleHelp server.
The attacker then used the platform's own tools to push malware its researchers named TaskWeaver and Djinn Stealer.
From Forged Token to Full Control
The flaw carries a maximum CVSS severity score of 10. In affected configurations, SimpleHelp failed to check the cryptographic signature of identity tokens in its OpenID Connect login, letting an unauthenticated attacker forge a token and sign in as a technician.
Instead of a phishing email or a standalone exploit, the attacker abused SimpleHelp's own file-transfer and remote-execution features to mass-deploy an obfuscated file disguised as the jQuery library, jquery.js, fetched from a temporary Cloudflare address and executed via Node.js. The firm said the trusted support channel let the activity blend in.
Read more on RMM attacks against MSPs: DragonForce Ransomware Leveraged in MSP Attack Using RMM Tool
A Loader and a Credential Sweep
Despite its name, jquery.js is a modular Node.js loader that its researchers track as TaskWeaver, built to evade static analysis. Its only command, "deliver", run whatever code the operator sent with full Node.js access so that it could drop a stealer one moment and a backdoor or ransomware the next.
The recovered payload, Djinn Stealer, was a cross-platform infostealer for Windows, macOS and Linux. Blackpoint said it swept a machine for cloud and infrastructure keys, source code and SSH credentials, cryptocurrency wallets and package-registry tokens that could seed a supply chain attack.
The rules went further than most stealers, reaching for the tokens behind AI coding assistants. Developers often grant those assistants standing access to code, databases and cloud accounts, so the stolen tokens hand an attacker that same reach, well beyond the AI itself.
Risk Beyond the Endpoint
Blackpoint warned that the damage outlasts the breached server: a single bypass became a path into cloud platforms, code repositories, AI tools and customer environments, with stolen credentials keeping that access alive after the endpoint is isolated. For managed service providers (MSPs), a single exposed server can affect every downstream customer.
SimpleHelp patched the flaw in late May, in versions 5.5.16 and 6.0 RC2. On June 29, after Blackpoint published its findings, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.
Blackpoint urged MSPs to patch, pull SimpleHelp off the internet and rotate any exposed secrets, treating credentials as compromised even after an endpoint is cleaned. The findings come from a single contained intrusion, with both malware families undocumented beforehand.

Sentinel — Human

Confidence

The text demonstrates a high degree of specificity and tightly integrated factual reporting, characteristic of specialized cybersecurity journalism rather than generalized machine generation.

Signals Detected
low severity: Sentence length variance and flow are varied; text maintains a specific, investigative rhythm rather than uniform AI cadence.
low severity: The analysis is focused and factually driven; it lacks the overly generalized or emotionally balanced framing typical of pure synthetic synthesis.
low severity: Specific attribution (Blackpoint Cyber, CVE number) and detailed causal chains suggest sourcing from specific investigative reporting rather than generic LLM retrieval patterns.
low severity: The claims are anchored by named entities and technical details, making external verification of the core facts straightforward. No obvious signs of LLM confabulation were detected.
Human Indicators
Specific naming of threat actors (TaskWeaver, Djinn Stealer) and security firms (Blackpoint Cyber) indicates specialized sourcing.
The integration of highly specific technical identifiers (CVE-2026-48558, CVSS score, specific software versions) suggests content rooted in detailed forensic reports.