Djinn stealer harvests cloud and AI credentials through SimpleHelp RMM flaw

A new information stealer called Djinn is being used to grab cloud and AI service credentials, Dark Reading reports. Attackers deliver it by exploiting CVE-2026-48558, a critical authentication-bypass flaw in the SimpleHelp remote-management tool, then use Djinn to target the credentials that link developer and administrator environments to broader enterprise systems. The focus on cloud and AI secrets reflects where valuable access now lives: API keys and tokens for cloud platforms and AI services can unlock far more than a single machine. Organizations that run SimpleHelp, especially unpatched instances, are the immediate exposure point for this credential theft.

Check

Confirm SimpleHelp servers are patched against CVE-2026-48558, and review developer and admin systems for credential theft and any unexpected use of cloud or AI service API keys and tokens.

Affected

Organizations running SimpleHelp remote-management software vulnerable to CVE-2026-48558; Djinn specifically hunts the cloud and AI service credentials that bridge developer and admin environments to wider enterprise systems.

Fix

Patch SimpleHelp immediately, rotate cloud and AI service credentials that may have been exposed, enforce least privilege and short-lived tokens, and monitor for unusual API key usage.