Djinn Stealer Deployed via SimpleHelp RMM Post-Exploitation (CVE-2026-48558)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.