Attackers are actively exploiting a recently disclosed critical vulnerability in SimpleHelp remote access software, tracked as CVE-2026-48558, to deploy a previously undocumented information stealer named Djinn Stealer. The exploit targets the software's remote access capabilities, allowing attackers to drop the malware onto compromised systems.
The vulnerability carries a high severity rating, though a specific CVSS score was not provided in available reports. Djinn Stealer is a cross-platform threat that targets Windows, macOS, and Linux systems, suggesting broad potential impact. Active exploitation has been confirmed, with security researchers observing attacks in the wild.
The attack vector involves the SimpleHelp vulnerability, which enables remote code execution. Once exploited, Djinn Stealer harvests sensitive information including credentials, browser data, and cryptocurrency wallet details. Indicators of compromise include unusual network connections to command-and-control servers associated with the malware.
SimpleHelp has released patches to address CVE-2026-48558. Administrators are urged to apply updates immediately and restrict remote access where possible. No additional workarounds have been published, but monitoring for suspicious network activity is recommended.
Attribution for the campaign remains unclear, as no group has claimed responsibility. The emergence of Djinn Stealer highlights the growing trend of information stealers being deployed through zero-day or recently patched vulnerabilities in widely used remote access tools.