SimpleHelp CVE-2026-48558 Exploited to Deploy Malware

A previously undocumented cross-platform information stealer is being deployed by attackers exploiting a critical vulnerability in a widely used remote management tool, according to a new analysis. The campaign leverages a recently disclosed authentication bypass flaw in SimpleHelp software to deliver a malware loader and a credential-stealing payload designed to harvest sensitive data from developer and administrator workstations, with a particular focus on credentials for artificial intelligence development tools.

The vulnerability, tracked as CVE-2026-48558 and carrying a maximum severity CVSS score of 10.0, affects SimpleHelp's OpenID Connect (OIDC) authentication flow. It allows an unauthenticated attacker to forge a token and obtain a fully authenticated "Technician" session on an internet-facing server. This grants the same remote management capabilities as a legitimate IT administrator, including the ability to transfer files and execute commands on all systems managed through that server.

Security researchers at Blackpoint Cyber documented an incident in which a threat actor exploited this flaw to gain access to a SimpleHelp server. The attacker then used that trusted...