A critical vulnerability in SimpleHelp is being actively exploited to distribute Djinn Stealer, a newly discovered malware capable of stealing data across Windows, macOS, and Linux systems.
Security researchers have identified active exploitation of CVE-2026-48558, a critical vulnerability in SimpleHelp remote support software. Attackers are leveraging the flaw to deploy Djinn Stealer, a previously undocumented information stealer with cross-platform capabilities.
Djinn Stealer targets three major operating systems—Windows, macOS, and Linux—making it a significant threat to organizations using SimpleHelp across diverse IT environments. The malware is designed to extract sensitive information from compromised systems, though specific data targets remain under investigation.
SimpleHelp, a remote access and support tool used by IT departments and managed service providers, is a high-value target for attackers seeking initial access to corporate networks. The critical severity rating of CVE-2026-48558 indicates the vulnerability allows remote code execution or similar high-impact compromise.
Organizations using SimpleHelp should immediately apply available patches. Security teams are advised to review access logs for suspicious activity and monitor systems for signs of Djinn Stealer infection, including unusual network connections or file modifications associated with information exfiltration.
The discovery underscores the ongoing risk posed by unpatched critical vulnerabilities in widely-used software. Remote access tools are particularly attractive targets for threat actors, as successful compromise provides immediate network foothold and credential harvesting opportunities.
Research into Djinn Stealer's full capabilities and infrastructure is ongoing. Additional details on indicators of compromise and technical analysis are expected as threat intelligence teams continue investigation.
Visa is enabling expired payment cards to continue processing contactless transactions through a new feature. The move allows cardholders to keep using their old cards for tap-to-pay purchases even after expiration.
A Texas-based student discovered and reported an unauthorized AI system being used for cyberattacks. The disclosure prompted immediate investigation and security responses from affected organizations.
A supply-chain attack is exploiting legitimate device-update apps to infect Android-based car head units with malware. The compromised devices are being enlisted into proxy botnets or used for ad fraud schemes.
Apollo Global Management disclosed a data breach in July resulting from a social engineering attack that exposed personal information. The incident joins a recent wave of cyberattacks targeting major hedge funds.