How attackers abuse SimpleHelp for remote access: artifacts, network IOCs, detections and blocking guidance. Free LOLRMM entry.

Cato CTRL investigates suspected MuddyWater phishing targeting Israeli organizations through Israel Tax Authority impersonation and SimpleHelp abuse.

Block unapproved software with application control built on threat research. Start in audit mode. Free forever for up to 100 endpoints.

Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas

Hackers are impersonating the Israel Tax Authority through phishing emails, fake government websites, and CAPTCHA-style checks to trick employees into running SimpleHelp remote access software. The campaign targets Israeli organizations and turns an ordinary tax-document request into a possible entry point for unauthorized access. Observed since September 2026, the activity targets a business task familiar to finance, accounting, and administrative staff. Instead of receiving a tax document, recipients download an archive containing an executable. The attack reflects broader phishing campaigns abusing RMM tools, where legitimate software becomes a route into company systems. Researchers from Cato Networks identified the campaign’s delivery infrastructure and examined its use of SimpleHelp. In their November 3 research report, Cato CTRL researchers said they suspect a connection to MuddyWater, although the evidence does not establish definitive attribution. CyberIL had previously reported the activity. Hackers Use Fake Government Websites and CAPTCHA Checks The attack starts with an email claiming to come from the Israel Tax Authority. Recipients who try to enter the supposed personal account area reach a lookalike website. Its government-themed name creates a misleading connection to Israel’s official government web namespace. The page then presents a checkbox, a Continue button, and an archive password. These details make the download resemble a protected document service. Unlike fake CAPTCHA command attacks that instruct victims to paste commands into Terminal, this chain uses verification to lead users toward a ZIP download and subsequent executable launch. Attack Flow (Source – Cato Networks) Inside the archive, the supposed tax document is actually a program. One sample carries a Hebrew filename meaning “Israel Tax Authority,” extending the impersonation beyond the browser. Opening it can deploy SimpleHelp configured to connect to infrastructure controlled by the attackers. SimpleHelp is legitimate remote support software, not inherently malware. Its normal features include desktop control, terminal access, file transfers, and system diagnostics. When deployed without authorization, those same functions could let an operator inspect business systems, run commands, retrieve files, or deliver additional tools. The distinction between capability and observation matters. Cato described these functions as potential attacker uses, not confirmed actions in this campaign. Its telemetry showed a blocked request to campaign infrastructure, rather than proof that an attacker completed a remote-access session or stole information. Suspected MuddyWater Links and the Limits of the Evidence Cato’s attribution assessment rests on Israeli targeting, locally tailored impersonation, and phishing that delivers legitimate remote-access software. Earlier MuddyWater remote access operations also involved SimpleHelp, providing relevant context. However, similarities in tools and targeting support suspicion rather than conclusive identification of the operator. The infrastructure investigation also used FOFA searches for two HTTP ETag values. Researchers found eight service records associated with one IP address, including two campaign domains displaying nginx “Coming Soon” pages. Verification interface used in the tax authority lure (Source – Cato Networks) Those eight records should not be mistaken for eight separate servers or confirmed victims. Cato notified SimpleHelp on October 20, 2026, and shared server information the following day. SimpleHelp identified both samples as Remote Access Client version 5.4.5 and assessed the findings as apparent malicious use of an older release. Neither party identified evidence of a software vulnerability being exploited. That separates this campaign from earlier SimpleHelp vulnerability exploitation incidents involving compromised remote-management deployments. Here, the documented entry point was social engineering intended to persuade users to install an attacker-configured client. Cato also found no evidence that SimpleHelp’s own infrastructure had been compromised in connection with this activity. Indicators of compromise (IoCs):- Type Indicator or source fragment Role or limitation Domain doc-taxes-govil[.]org ZIP delivery Domain document-govil[.]com ZIP delivery; blocked request Domain doc26-govil[.]org ZIP delivery Domain document-govil[.]online ZIP delivery IP 129.121.120[.]121 Reported command-and-control address IP 169.58.239[.]210 Reported abused SimpleHelp server IP 161.97.138[.]129 Reported abused SimpleHelp server URL fragment https://docs[.]templateoption Truncated suspected campaign URL SHA-256 prefix 0d881ad82ddf4ccdb18c8995 document.zip ; incomplete SHA-256 prefix f018003432114393db3bd27a document.exe ; incomplete SHA-256 prefix 6ba34f275f27a2584c7d653f Israel_Tax_Authority.zip ; incomplete SHA-256 prefix 62a25285436c5e34a426613 Hebrew-named executable; incomplete Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Use Fake Government Websites and CAPTCHA Checks to Deliver SimpleHelp Remote Access Software appeared first on Cyber Security News .

TL;DR Security researchers uncovered a MuddyWater SimpleHelp campaign that has targeted Israeli businesses since September 2026. Phishing messages impersonate the Israel Tax Authority to trick finance workers into installing remote management software. Furthermore, automated cloud protections blocked requests to the attacker server before operators could establish remote control. What Happened in the Campaign Threat actors sent phishing emails impersonating the Israel Tax Authority to administrative and accounting employees.

ハッカーが、イスラエル税務庁（Israel Tax Authority）を装ったフィッシングメールでイスラエルの組織を狙っています。このメールは、税務書類に見せかけたリモートアクセスソフトを送り付けます。 提供された調査によると、このキャンペーンは2026年9月から活動しています。攻撃者は、正規のリモート監視・管理ツ

Researchers found two previously undisclosed malware samples used to steal AI assistant tokens and other valuable secrets.

On July 1, 2026, Apple released security updates for iOS, iPadOS, macOS, and Safari, addressing 28 vulnerabilities, primarily in WebKit, with additional kernel vulnerabilities that may impact watchOS, visionOS, and tvOS. Some patches were backported from beta versions of upcoming major OS releases. Separately, cybersecurity firm Blackpoint reported an intrusion into SimpleHelp, a remote tech support platform, exploiting an OpenID Connect bypass to authenticate as a technician and deploy obfuscated JavaScript malware (named 'jQuery.js') via NodeJS to steal credentials. Mozilla’s Odin Lab disclosed an attack vector involving cloned Git repositories, where AI-assisted initialization triggers a DNS lookup to fetch and execute malicious code from a DNS TXT record, demonstrating DNS as a covert channel. The SimpleHelp vulnerability was noted as easily exploitable and potentially ransomware-ready, though no ransomware deployment was observed in this case.

An unidentified threat actor has exploited CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp with a CVSS score of 10.0, to deploy two previously unreported malware families: TaskWeaver and Djinn Stealer. The flaw affects the OpenID Connect (OIDC) flow, allowing unauthenticated attackers to compromise systems. No specific timeline or geographic targeting was disclosed in the observed intrusion. The attack leverages the maximum-severity vulnerability to deliver the new malware strains, though their exact functionality remains unconfirmed. SimpleHelp’s software is the primary target, with no additional affected products mentioned.

Una vulnerabilidad crítica en SimpleHelp, una plataforma de gestión remota (RMM) muy utilizada por proveedores de servicios gestionados (MSP), departamentos de TI y equipos de sopo…

Threat actors are exploiting a known security flaw in the SimpleHelp remote monitoring and management (RMM) software to drop two previously unknown pieces of malware that can compromise a broad range of systems and steal massive amounts of sensitive data. Researchers with Blackpoint Cyber’s Adversary Pursuit Group said they detected an intrusion in which the […]

Parchea el CVE-2026-48558: Vulnerabilidad crítica en SimpleHelp permite acceso total a servidores. Guía técnica de remediación y mitigación.

aperCut NG/MFのゼロデイ 脆弱性 CVE-2026-81578とCVE-2026-82078をCISAがKEVへ追加。Huntressは2件を連鎖した認証前RCEを再現し、実攻撃2件を確認しました。SimpleHelp導入やAnyDeskダウンロードなど新たな侵害後活動も判明しています。

PaperCut says a threat actor is exploiting two zero-day vulnerabilities in PaperCut NG and MF to gain access to internet-facing Application Servers and covertly install legitimate remote access tools such as SimpleHelp and AnyDesk. The vendor has released emergency patches and urged customers to restrict access, preserve forensic evidence, and rebuild affected servers if compromise is suspected. #PaperCut #CVE-2026-81578 #CVE-2026-82078 #SimpleHelp #AnyDesk