A Djinn in the Machine: TaskWeaver's Node.js Intrusion Chain

Reported 30 Jun 2026 by otx · Severity: medium

An intrusion was investigated that began with exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software. The threat actor obtained unauthorized technician access and deployed two previously undocumented malware samples: TaskWeaver a