OTX Threat: A Djinn in the Machine: TaskWeaver's Node.js Intrusion Chain

An intrusion was investigated that began with exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software. The threat actor obtained unauthorized technician access and deployed two previously undocumented malware samples: TaskWeaver and Djinn Stealer. TaskWeaver is a heavily obfuscated Node.js loader that establishes encrypted communications and delive CVEs: CVE-2026-48558 Sectors: Technology