Djinn Stealer via SimpleHelp RMM - Credential Harvest & C2 Exfil (CVE-2026-48558)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.