🤚 The Open-Palm Disclosure

A previously undocumented cross-platform information stealer called Djinn has been deployed in the wild through a critical authentication bypass in SimpleHelp, a remote monitoring and management tool used by IT departments, managed service providers, and helpdesks worldwide. The vulnerability, tracked as CVE-2026-48558, allows attackers to create highly privileged technician accounts without authentication by exploiting SimpleHelp’s OpenID Connect (OIDC) implementation — which is a sentence that should make every sysadmin who has ever said “our RMM is trusted infrastructure” quietly close their laptop and stare at the wall.

Approximately 1,000 vulnerable SimpleHelp servers were exposed on the internet at the time of disclosure. Horizon3.ai identified the vulnerability; Blackpoint Cyber’s Adversary Pursuit Group investigated the in-the-wild exploitation and documented the Djinn payload.

👐 The Two-Handed Extraction

What makes Djinn exceptional — in the way that a particularly well-organized burglar is exceptional — is its target list. This is not your grandmother’s credential stealer. Djinn specifically harvests:

• AI coding assistant tokens — Claude, Gemini, Codeex, and Cline
• Cloud provider credentials and deployment platform configs
• Git, GitHub, SSH, and Docker credentials
• Cryptocurrency wallets across multiple blockchains
• Browser data, shell history, PGP keys, and database configurations

Read that first bullet point again. AI coding assistant tokens. Someone built a malware specifically designed to steal your Claude API key, your Gemini credentials, and whatever token your Cline extension uses. The AI coding revolution has been running for approximately eighteen months and it already has a purpose-built pickpocket. The future arrived exactly on schedule, and it brought crime with it.

The attack chain is elegant in the way that things you don’t want to be elegant are elegant. A malware loader called TaskWeaver downloads as obfuscated JavaScript, fingerprints the target device, phones home to command servers, and then deploys Djinn for the actual credential harvest. Before exfiltration, everything gets packed into a TAR archive, compressed with GZIP, and encrypted with AES-256-GCM. Your stolen API keys leave your machine better-encrypted than most companies’ production databases.

🌿 The Gentle Awakening

There is a delicate irony in the fact that the tools developers adopted to write code faster have created an entirely new category of credential to steal. Three years ago, no malware author would have thought to look for a Claude API token, because Claude API tokens didn’t exist. Now they’re valuable enough to warrant a dedicated harvesting module in a cross-platform infostealer that targets Windows, macOS, and Linux simultaneously.

The SimpleHelp vector is also a masterclass in trust exploitation. Remote management tools exist precisely because they have elevated access to systems. They’re trusted by firewalls, whitelisted by endpoint protection, and ignored by most monitoring. When an attacker creates a privileged technician account on your RMM platform, the malware doesn’t need to sneak in. It walks through the front door wearing a visitor badge issued by your own security system.

👑 The Gold-Leaf Credential Economy

The emergence of AI API tokens as a primary theft target tells you everything about where value lives in the modern developer ecosystem. An enterprise Claude API key with a generous spending limit is not a convenience — it’s a financial instrument. A stolen Gemini token can generate thousands of dollars in compute before anyone checks the billing dashboard. These keys don’t just access models; they access budgets.

And unlike a stolen credit card, which gets flagged after the first suspicious purchase, a stolen API key generates traffic that looks exactly like legitimate usage. The attacker doesn’t need to cash it out. They just use it — to run their own AI workloads, to resell access on underground markets, or to train competing models on your dime.

If your organization uses SimpleHelp, patch immediately. If your developers store AI assistant tokens on their machines — and they do, because that’s how the tools work — those tokens need rotation, monitoring, and the kind of paranoia that was once reserved for SSH private keys. Welcome to the era where your coding assistant’s API key is as valuable as your database password, and considerably easier to steal.

“The malware specifically listed Claude, Gemini, and Cline in its target manifest. We were flattered, then terrified, then flattered again.” — The Slap of Wisdom Credential Rotation Bureau, changing API keys from a machine that was definitely not compromised, probably