The flaw carries a maximum CVSS severity score of 10 — and attackers used it to sign in as a trusted technician, then push previously unseen malware across customer environments.
CVE-2026-48558: forged OpenID Connect tokens and a technician session
Security firm Blackpoint Cyber reported that an authentication bypass in SimpleHelp's remote monitoring and management (RMM) software, tracked as CVE-2026-48558, allowed an unauthenticated attacker to forge an identity token and obtain a trusted technician session on an internet-facing SimpleHelp server. In affected configurations, SimpleHelp failed to check the cryptographic signature of identity tokens in its OpenID Connect login, the firm said — enabling the attacker to sign in as a technician without valid credentials.
From trusted channel to mass deployment: how the attacker moved
Rather than rely on phishing or a standalone exploit, the intruder abused SimpleHelp's built-in file-transfer and remote-execution features to mass-deploy an obfuscated file masquerading as the JavaScript library jquery.js. The file was fetched from a temporary Cloudflare address and executed via Node.js, Blackpoint said. Because the activity came through the RMM's trusted support channel, it blended in with normal administrative operations and avoided easy detection.
TaskWeaver loader and the modular "jquery.js" delivery
Blackpoint's analysis identified the deployed loader as TaskWeaver. Despite its jquery.js filename, TaskWeaver is a modular Node.js loader designed to evade static analysis. Its only recorded command, "deliver", runs operator-supplied code with full Node.js privileges, meaning an operator could drop a stealer in one action and a backdoor or ransomware in the next. Blackpoint described TaskWeaver as built to execute whatever the operator sends, giving the attacker flexible post-compromise capabilities.
Djinn Stealer: cross-platform credential sweep and AI-assistant tokens
The secondary payload recovered by Blackpoint is tracked as Djinn Stealer, a cross-platform infostealer aimed at Windows, macOS and Linux. The malware searched targets for cloud and infrastructure keys, source code and SSH credentials, cryptocurrency wallets, and package-registry tokens — and, notably, tokens used by AI coding assistants. Blackpoint warned that stolen tokens for AI assistants can grant an attacker the standing access developers typically give those tools, providing reach into code, databases and cloud accounts beyond the AI itself.
Impact on MSPs, security teams, and customers
- Managed service providers (MSPs): Blackpoint warned that a single exposed SimpleHelp server can affect every downstream customer, because the trusted technician session and stolen credentials persist even after an endpoint is isolated.
- Security teams and incident responders: Blackpoint urged patching, taking SimpleHelp instances offline from the internet, and rotating any exposed secrets — treating credentials as compromised even after cleanup.
- DevOps and developers: the attack's focus on AI-assistant tokens and package-registry tokens highlights a risk that credentials tied to development tooling can be leveraged to reach source code and cloud environments.
Patching, disclosure timeline, and official action
SimpleHelp issued patches in late May; fixed versions appear as 5.5.16 and 6.0 RC2, according to Blackpoint. After Blackpoint published its findings, the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 29. Blackpoint characterized the reported activity as coming from a single contained intrusion and noted that both malware families were previously undocumented.
The facts in Blackpoint's report point to a familiar but striking lesson: a single verification gap in an authentication flow turned an internet-facing management server into a launchpad for broad credential theft. The firm’s concrete advice — patch, remove internet exposure, rotate secrets and assume credentials are compromised — is equally direct. Whether organizations follow those steps promptly will determine if this incident remains a contained case study or becomes the seed for follow-on cloud and supply-chain intrusions.
Original reporting: https://www.infosecurity-magazine.com/news/simplehelp-rmm-vulnerability/
