Critical SimpleHelp Vulnerability Exploited for Malware Delivery

A critical authentication bypass vulnerability in SimpleHelp remote management software, scoring a perfect 10 out of 10 on the severity scale, has been actively exploited to deliver malware onto managed systems. The flaw, which fails to verify cryptographic signatures when OpenID Connect authentication is configured, allowed attackers to deploy TaskWeaver loader and Djinn Stealer, which specifically targets developer credentials including cloud keys, SSH access, and even AI development tool credentials. The vulnerability was patched in late May, and CISA has now added it to its catalog of actively exploited vulnerabilities, giving federal agencies just three days to update their systems.