~/f4n6 $ grep -r "'Djinn' Stealer Targets Cloud, AI Credentials" ./investigations/ --include="*.md"

'Djinn' Stealer Targets Cloud, AI Credentials

Jeff Davies 29 Jun 2026 6 min read

1. Executive summary

A previously undocumented cross-platform infostealer dubbed "Djinn Stealer" is being deployed in the wild via exploitation of CVE-2026-48558, a critical (CVSS 9.5) cryptographic signature verification flaw in SimpleHelp remote-support software. The vulnerability (CWE-347: Improper Verification of Cryptographic Signature) is listed on CISA KEV (added 2026-06-29) and enables an authentication bypass that delivers the stealer to target environments. Djinn specifically targets credentials linking development and admin environments to wider enterprise systems — including cloud and AI service credentials — representing a direct risk to EMEA financial services firms whose build pipelines and admin tooling bridge to production data and cloud infrastructure. EPSS for the CVE is 1%, indicating low observed exploitation pressure at time of writing, but the coupling of a KEV-listed critical with a purpose-built credential stealer elevates the operational risk.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process Active exploitation of a CISA-KEV-listed CVE (CVE-2026-48558) delivering infostealer malware into enterprise environments Financial institutions must have a process to detect, triage, and respond to this incident class — including containment of credential theft from dev/admin systems bridging to production
DORA Art. 18: classification of ICT-related incidents and cyber threats CVSS 9.5 CRITICAL, CISA-KEV listed, infostealer targeting cloud/AI credentials This incident warrants classification as a major ICT-related incident given the critical severity and credential exfiltration targeting enterprise-connected systems
DORA Art. 19: reporting of major ICT-related incidents to competent authorities If a financial institution confirms Djinn Stealer deployment within its environment, credential exfiltration to infrastructure bridging dev/admin to production constitutes a major incident Triggered reporting obligation upon confirmed compromise; assess and notify competent authorities per institutional threshold criteria
NIS2 Art. 21(2)(d): supply chain security measures SimpleHelp is a third-party ICT component being actively exploited as the initial access vector Entities subject to NIS2 must assess SimpleHelp as part of their supply chain risk — verify patch status, exposure, and vendor remediation
NIS2 Art. 23: incident reporting obligations Confirmed deployment of Djinn Stealer via CVE-2026-48558 within a NIS2-entity environment Incident reporting obligations engage upon confirmed compromise; notify CSIRT/national authority per national transposition timelines
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties If an OES or RDSP operates SimpleHelp in scope of its service delivery, exploitation of CVE-2026-48558 is an incident affecting service availability/integrity OES/RDSP must manage this as an incident under their NIS duties — assess exposure, contain, and report as applicable

3. Technical analysis & attack chain

Confirmed attack chain

  1. Initial access via CVE-2026-48558 — Attackers exploit a critical authentication bypass in SimpleHelp remote-support software. The vulnerability (CVSS 9.5, CWE-347: Improper Verification of Cryptographic Signature) allows attackers to bypass authentication mechanisms and gain access to the target environment via the SimpleHelp platform.
  2. Djinn Stealer deployment — Following exploitation, the previously undocumented "Djinn Stealer" malware is delivered to the compromised host. Djinn is a cross-platform infostealer targeting Windows, macOS, and Linux systems.
  3. Credential targeting — Djinn specifically harvests credentials that link development and admin environments to wider enterprise systems. The stealer is purpose-built to collect cloud and AI service credentials — credentials that typically provide lateral access from dev/admin infrastructure into production data stores, cloud platforms, and AI/ML service APIs.

Technical specifics

  • Exploited component: SimpleHelp remote-support software (CVE-2026-48558)
  • Vulnerability class: Improper Verification of Cryptographic Signature (CWE-347) — the flaw allows authentication bypass, meaning attackers can circumvent access controls on the SimpleHelp platform to deliver payloads
  • CVSS: 9.5 CRITICAL (authoritative per NVD/verified reference data)
  • CISA KEV status: Listed, added 2026-06-29
  • EPSS: 1% — low exploitation prevalence at time of writing
  • Malware: Djinn Stealer — cross-platform (Windows, macOS, Linux), previously undocumented at time of reporting
  • Target data: Cloud credentials, AI service credentials, credentials bridging dev/admin to enterprise systems

Confidence caveat: Attribution of the campaign to a specific threat actor is unconfirmed — no named actor with a MITRE ATT&CK profile is identified in the verified reference data or the source material. The existence of Djinn Stealer and its delivery via CVE-2026-48558 is corroborated across two sources (DarkReading and BleepingComputer), but specific technical details of the malware's internal operation, C2 infrastructure, persistence mechanisms, and full IOC set are single-sourced or not yet available in the provided material. Verify before enforcement.

Discrepancy note: The source material references CVE-2026-48558 as an "authentication bypass" vulnerability. The verified reference data classifies this as CWE-347 (Improper Verification of Cryptographic Signature). These are not contradictory — an authentication bypass can result from improper cryptographic signature verification. The CWE-347 classification is authoritative.

4. Mitigation & containment

P1 — Within 24 hours

  1. Identify all SimpleHelp deployments across the estate. Search for SimpleHelp server and client components: - Check for SimpleHelp services on Windows: sc query | findstr -i simplehelp - Check for SimpleHelp processes: tasklist / ps aux | grep -i simplehelp - Review firewall rules exposing SimpleHelp ports to the internet
  2. Isolate SimpleHelp instances that are internet-facing or accessible from untrusted networks. Restrict access to internal/VPN-only.
  3. Block known Djinn Stealer C2 traffic at egress filtering — note: specific C2 IOCs are not available in the source material; monitor for anomalous outbound connections from SimpleHelp host processes.
  4. Hunt for Djinn Stealer artefacts — the malware is cross-platform (Windows/macOS/Linux). Search for previously unknown binaries executed from SimpleHelp process trees. Review EDR telemetry for process spawns from SimpleHelp service processes.

P2 — Within 72 hours

  1. Patch SimpleHelp — apply the vendor fix for CVE-2026-48558 if available. Check the SimpleHelp vendor advisory for the fixed version. If no patch is available, disable the SimpleHelp service and isolate affected hosts.
  2. Audit credential exposure — identify all cloud and AI service credentials stored on or accessible from SimpleHelp-hosting systems. Rotate credentials for: - Cloud provider access keys (AWS, Azure, GCP) - AI/ML service API keys - Dev/admin to production bridge credentials - CI/CD pipeline tokens
  3. Review SimpleHelp access logs for authentication anomalies consistent with CVE-2026-48558 exploitation — look for unauthenticated sessions, unexpected session creation, or bypassed auth flows.

P3 — Within 7 days

  1. Conduct full host forensic review of all SimpleHelp servers — examine for Djinn Stealer persistence mechanisms, scheduled tasks, and credential dump artefacts.
  2. Implement network segmentation — ensure SimpleHelp infrastructure cannot bridge dev/admin environments to production without explicit controls.
  3. Update EDR/YARA rules with Djinn Stealer signatures once available from vendor threat intelligence feeds.
  4. Review and update incident response playbooks to include infostealer credential-exfiltration scenarios specific to cloud/AI credential theft.

5. Indicators of compromise

No indicators of compromise available in the source material. Specific file hashes, C2 domains, IP addresses, mutex names, and registry artefacts for Djinn Stealer are not provided in the available sources. This is a single-sourced threat at time of writing; verify IOCs from vendor threat intelligence before enforcement.

6. Detection

Insufficient indicators to author detection rules. The source material does not provide distinctive strings, file hashes, mutex names, registry keys, C2 infrastructure, or command-line artefacts for Djinn Stealer. Once vendor threat intelligence publishes IOCs, prioritise YARA rules targeting the stealer binary and Sigma rules for C2 network connections.

In the interim, deploy behavioural detection:

  • Monitor for unexpected process creation from SimpleHelp service processes
  • Alert on anomalous outbound network connections from SimpleHelp host systems
  • Flag credential file access (e.g., .aws/credentials, .ssh/, environment files containing API keys) from processes spawned by SimpleHelp

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-48558 9.5 Critical ⚠ KEV 2026-06-29 1% SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC au…

7. Sources

  • DarkReading — "'Djinn' Stealer Targets Cloud, AI Credentials" — https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials — 2026-06-29
  • BleepingComputer — "Critical SimpleHelp flaw exploited to deploy new stealer malware" — https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/ — 2026-06-29

8. Adverse Trace position

CVE-2026-48558 is a CVSS 9.5 CRITICAL vulnerability in SimpleHelp, listed on CISA KEV as of 2026-06-29, with confirmed active exploitation delivering the previously undocumented Djinn Stealer. The threat is corroborated across two independent sources (DarkReading and BleepingComputer), though attribution to a named threat actor is unconfirmed and the IOC set is not yet available — this remains single-sourced for technical malware detail. The targeting profile — cloud and AI credentials bridging dev/admin to enterprise — is directly relevant to EMEA financial services firms with cloud-native and AI-adjacent infrastructure. EPSS at 1% suggests early-stage exploitation, but the KEV listing and critical severity warrant immediate action. We are monitoring for IOC publication and will issue a update with detection rules and IOCs when available. Clients should immediately inventory SimpleHelp deployments, restrict external exposure, and prepare for credential rotation across cloud and AI service accounts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies