Djinn Stealer Malware

Overview A newly disclosed vulnerability in SimpleHelp (CVE‑2026‑48558) is being actively exploited by hackers to deploy Djinn Stealer, a cross‑platform information stealer targeting Windows, macOS, and Linux. The flaw, discovered by Horizon3.ai, allows attackers to create highly privileged technician accounts without authentication on servers using OpenID Connect (OIDC).

With roughly 1,000 vulnerable SimpleHelp servers exposed online at the time of disclosure, the exploitation represents a serious risk for managed service providers (MSPs), IT departments, and helpdesks that rely on SimpleHelp for remote monitoring and management.

Exploit Chain

Stage	Details
Vulnerability	CVE‑2026‑48558 — Authentication bypass in OIDC configuration
Initial Access	Attacker creates privileged technician session
Loader Deployment	TaskWeaver malware loader delivered as obfuscated jquery.js via Cloudflare domain
Payload	Djinn Stealer installed to harvest credentials and sensitive data

The compromised RMM platform provided attackers with a trusted administrative channel, enabling file transfers and command execution across managed systems.

Djinn Stealer Capabilities

Djinn Stealer is designed to harvest developer, infrastructure, and crypto credentials in a single pass:

• Cloud & Identity → AWS, Azure, GCP, identity services, deployment platforms.
• Developer Tools → Git configs, GitHub CLI, SSH keys, Docker, Helm, Terraform, Pulumi.
• Package Managers → npm, Yarn, Maven, Gradle, pip, NuGet, Cargo.
• AI Development Tools → Claude, Gemini, Codex, Cline, OpenCode, Kilo via stolen MCP configs.
• Crypto Wallets → Bitcoin, Ethereum, Monero, Zcash, Exodus, Atomic Wallet, Electrum.
• System Data → Browser history, shell logs, SSH configs, PGP keys, DB client configs.

On Linux, Djinn Stealer also reads /proc/<pid>/cmdline and /proc/<pid>/environ to extract secrets such as API keys and session tokens.

Data Exfiltration Routine

Before exfiltration, Djinn Stealer:

1. Packs stolen data into a TAR archive.
2. Compresses with GZIP.
3. Encrypts using AES‑256‑GCM, with the key protected by an embedded RSA‑2048 public key.

This layered routine ensures secure delivery of stolen data to attacker C2 infrastructure, complicating detection and forensic recovery.

Defensive Recommendations

For system administrators and MSPs:

• Update SimpleHelp immediately to the latest version.
• Invalidate suspicious technician sessions to prevent unauthorized access.
• Rotate all credentials and API keys if compromise is suspected.
• Monitor for TaskWeaver IoCs and Djinn Stealer hashes.
• Harden RMM platforms with strict authentication and network segmentation.

Expert in the Cloud Insight

The exploitation of SimpleHelp demonstrates how remote monitoring platforms can become high‑value attack vectors. By compromising trusted administrative channels, attackers gain privileged access to developer ecosystems, cloud infrastructure, and even AI assistants.

For enterprises, this incident is a reminder that RMM platforms must be treated as critical infrastructure. Patch management, credential rotation, and continuous monitoring are not optional — they are essential to prevent cascading compromise across hybrid environments.