Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer

A previously unknown threat actor is leveraging a critical vulnerability in SimpleHelp, specifically CVE-2026-48558, to deploy two novel malware strains, TaskWeaver and Djinn Stealer. This maximum-severity flaw, carrying a CVSS score of 10.0, enables attackers to bypass authentication in the OpenID Connect flow, allowing unauthorized access. The exploitation of this vulnerability significantly expands the attack surface, particularly for entities relying on SimpleHelp and OpenID Connect. The emergence of TaskWeaver and Djinn Stealer malware families underscores the evolving threat landscape, with attackers continually seeking new avenues to compromise systems. The fact that these malware strains are being delivered through the exploitation of a recently disclosed vulnerability¹ highlights the importance of prompt patching and vigilance. This development matters to security practitioners because it necessitates a thorough review of their exposure to CVE-2026-48558 and the implementation of mitigations to prevent potential breaches.