Executive Summary
Blackpoint Cyber's Adversary Pursuit Group identified a sophisticated intrusion campaign exploiting CVE-2026-48558, a critical authentication bypass in SimpleHelp Remote Monitoring and Management (RMM) software. This vulnerability allows unauthenticated attackers to obtain technician sessions by bypassing OIDC signature verification. Once access is gained, the actor leverages the RMM's legitimate file transfer and remote execution capabilities to deploy TaskWeaver, a heavily obfuscated Node.js loader.
TaskWeaver serves as a modular delivery mechanism for Djinn Stealer, a cross-platform information stealer written in JavaScript. Djinn Stealer is notably comprehensive, targeting not only standard browser credentials and cryptocurrency wallets but also critical developer infrastructure secrets, cloud provider tokens (AWS, Azure, GCP), and session data from AI development assistants like Claude and Gemini.
This campaign represents a significant risk to Managed Service Providers (MSPs) and their downstream customers. By compromising a single RMM server, attackers gain a trusted administrative pathway to deploy malware across all managed endpoints. The theft of AI assistant tokens is particularly concerning, as these tokens often inherit extensive permissions to repositories, databases, and cloud accounts, facilitating deep lateral movement and supply chain compromise.