Djinn Stealer: How a SimpleHelp Flaw Unleashed AI Tool Targeting Malware

The Djinn Stealer malware campaign represents a sophisticated, targeted attack chain that exploits a critical authentication bypass vulnerability in the SimpleHelp remote monitoring and management (RMM) platform—CVE-2026-48558—to compromise enterprise developer environments across Windows, macOS, and Linux, harvesting sensitive AI and cloud credentials.

The Exploitation Chain: From RMM Bypass to Credential Harvesting

CVE-2026-48558 is a critical flaw in SimpleHelp's authentication middleware that allows unauthenticated attackers to escalate to full administrative privileges by manipulating session tokens in HTTP headers. Unlike typical credential stuffing or brute-force attacks, this vulnerability enables direct access to the administrative console without any prior knowledge of credentials. Offensive security company Horizon3.ai published details about the flaw, noting it could be leveraged on servers using the OpenID Connect (OIDC) authentication protocol. At the time of disclosure, approximately 1,000 SimpleHelp servers were exposed online with vulnerable configurations.

According to threat intelligence from Blackpoint's Adversary Pursuit Group (APG), attackers began exploiting this flaw in early Q1 2026, targeting organizations with exposed SimpleHelp instances—particularly those used by managed service providers (MSPs), IT departments, and system administrators to manage remote developer workstations.

Once inside, attackers deployed TaskWeaver, a malware loader downloaded as an obfuscated JavaScript file named 'jquery.js' from a temporary Cloudflare domain. TaskWeaver is not merely a PowerShell script—it fingerprints the compromised device and communicates with command-and-control (C2) infrastructure to receive new JavaScript modules for execution. Its primary function was to establish persistence and reconnaissance capabilities on compromised hosts before installing the Djinn Stealer payload.

Targeting AI Toolchains and Developer Secrets Across Platforms

The Djinn Stealer payload was not a generic data exfiltrator. It was meticulously engineered as a cross-platform stealer targeting Windows, macOS, and Linux systems. Upon execution, Djinn Stealer performed a multi-stage scan:

• AI Tool Configurations via MCP: It searched for and exfiltrated Model Context Protocol (MCP) configuration files for AI coding assistants including Claude, Gemini, Codex, Cline, OpenCode, and Kilo. As Blackpoint researchers explain: "Many of these tools rely on the Model Context Protocol (MCP) to connect an AI assistant to external tools and data on the developer's behalf, including source repositories, databases, cloud accounts, and internal APIs." Settings and tokens for those connections are stored locally in files such as ~/.claude/mcp.json. Stealing them grants an attacker the same downstream access the developer extended to their AI agent.
• Cloud Provider Credentials: The stealer scanned for AWS, Azure, and GCP credential files—.aws/credentials, ~/.azure/credentials, and ~/.config/gcloud/credentials.json—as well as service account keys in JSON format.
• SSH and Git Keys: It harvested SSH private keys (id_rsa, id_ed25519), Git credential helpers storing tokens or passwords in plaintext, and GitHub CLI configuration.
• CI/CD and Infrastructure-as-Code: The payload targeted deployment platforms, secrets management solutions (HashiCorp Vault), and IaC tools including Terraform and Pulumi.
• Package Manager Credentials: Authentication data for package registries and build tools—npm, Yarn, pnpm, Cargo, Maven, Gradle, pip, and NuGet—potentially enabling access to private packages or malicious package publication.
• Cryptocurrency Wallets: Djinn Stealer specifically targeted desktop cryptocurrency clients including Bitcoin, Litecoin, Dogecoin, Dash, Ethereum, Monero, Zcash, Exodus, Atomic Wallet, and Electrum.
• Browser Data and System Info: Browser data, shell history, SSH configuration, PGP keys, database client configuration, and operating system information.

On Linux specifically, the malware attempts to read /proc/<pid>/cmdline and /proc/<pid>/environ virtual files that contain information about running processes, including secrets such as API keys, credentials, session tokens, file paths, and URLs.

Exfiltration Methodology

Before exfiltrating the stolen data to the C2 server, Djinn Stealer packs it into a TAR archive, compresses it with GZIP, and encrypts it using an AES-256-GCM key protected by an RSA-2048 public key embedded in TaskWeaver.

Why This Campaign Is Uniquely Dangerous

Traditional malware campaigns target financial data or login credentials. Djinn Stealer's focus on AI toolchains and cross-platform developer environments introduces a new threat vector: the theft of intellectual property and access to compute resources. Compromised AI API keys and MCP tokens can be used to:

• Run unauthorized LLM inference at scale, incurring massive cloud bills for the victim.
• Poison training data by injecting malicious prompts into public model fine-tuning pipelines.
• Generate synthetic code or documentation to obfuscate further malware activity.
• Access proprietary models or datasets hosted in cloud AI platforms.
• Inherit the AI assistant's authorized access to repositories, cloud resources, databases, and APIs through stolen MCP tokens.

This represents a shift from stealing credentials to stealing capabilities. Once an attacker has access to an organization's AI infrastructure, they can automate reconnaissance, generate phishing content, or even train adversarial models to bypass security controls.

Attribution and Indicators of Compromise (IoCs)

While attribution remains speculative, the malware's code structure, use of JavaScript obfuscation techniques, and deployment pattern suggest ties to a financially motivated threat actor with prior experience in RMM exploitation. Blackpoint's Adversary Pursuit Group confirmed both TaskWeaver and Djinn Stealer are new and previously undocumented. IoCs include:

• File Hashes: Available in Blackpoint's full report for both TaskWeaver loader and Djinn Stealer
• Network Infrastructure: C2 domains and temporary Cloudflare hosting used for TaskWeaver delivery
• Behavioral Indicators: Obfuscated JavaScript masquerading as 'jquery.js', unusual outbound connections to known C2 domains

Mitigation and Defense Recommendations

Organizations using SimpleHelp should immediately:

1. Patch CVE-2026-48558 via the vendor's emergency patch (SimpleHelp v3.8.1+).
2. Disable RMM access from public-facing networks until patching is complete.
3. Invalidate unrecognized technician sessions on SimpleHelp servers.
4. Rotate all cloud, API, SSH, and crypto credentials on systems that had SimpleHelp installed.
5. Implement credential scanning in CI/CD pipelines and developer workstations using tools like TruffleHog or GitGuardian.
6. Monitor for anomalous JavaScript execution and unusual outbound connections to known C2 domains.

For AI teams: treat API keys, MCP tokens, and model access credentials as high-value secrets. Store them in secrets managers (e.g., HashiCorp Vault, AWS Secrets Manager) with rotation policies and access audits—not in plaintext configuration files.

Conclusion

The Djinn Stealer campaign is a harbinger of a new era in cybersecurity: where the theft of AI tool access via cross-platform stealers is as dangerous as the theft of passwords. This attack demonstrates that the most valuable assets in modern enterprises are no longer just data—they are the capabilities enabled by AI and automation. Defending against such threats requires a paradigm shift: treating developer toolchains with the same rigor as production infrastructure, and securing AI credentials with the same urgency as financial data.