Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
SimpleHelp OIDC Bypass Lets Attackers Gain Technician Session and Deploy Malware
Malware Families
Excerpt
A critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software. The flaw allows unauthenticated attackers to forge identity tokens within SimpleHelp’s OpenID Connect (OIDC) authentication flow, granting them a fully authenticated technician session without valid credentials. Following Blackpoint’s disclosure, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48558 to its Known Exploited…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-48558 | Medium | Score 57/100 | First seen |
| SHA256 | f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc | Medium | Score 53/100 | First seen |
| Domain | trycloudflare.com | High | Score 67/100 | First seen |
| Domain | a.dev-tunnels.com | Medium | Score 54/100 | First seen |
| SHA256 | 00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c | Medium | Score 53/100 | First seen |
| IP | 96.126.130.126 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…