'Djinn' Stealer Targets Cloud, AI Credentials

Attackers exploited CVE-2026-48558 in the SimpleHelp RMM platform to gain admin-equivalent remote access, mass-deploy an obfuscated JavaScript loader (TaskWeaver) masquerading as jsquery.js, and retrieve Djinn Stealer. Djinn Stealer harvests a wide array of high-value credentials — cloud keys, SSH keys, package-registry tokens, CI/CD secrets, and AI development tool tokens — packages them, encrypts the data for exfiltration, and poses elevated supply-chain and enterprise risk due to the trusted nature of RMM access.