Skip to content
Bulwark Black Bulwark Black LLC
Latest
Jscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware FuelNetNut and Popa Takedown Shows Residential Proxies Are Now Attack InfrastructureVect and TeamPCP Show Supply-Chain Credentials Are Ransomware FuelOusaban Shows Banking Trojans Are Learning to Hide From SandboxesNUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue

Indicator of Compromise

CVE-2026-48558

CVE Seen in 2 reports Watch this →

A CVE identifier for a specific software vulnerability referenced in this reporting.

Seen in these reports

Cyber Security Blog · Jun 30, 2026

SimpleHelp Exploitation Shows RMM Is a Credential Control Plane
Cyber Security Blog · Jun 1, 2026

FortiClient EMS Exploitation Turns Endpoint Management Into an Infostealer Delivery System

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e 17e771c78430cc67e71d4547f8996a1a488e9d3f 185[.]220[.]101[.]15192[.]42[.]116[.]14 2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb2 2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff 338662fd0c4d750a0ba203a32b59f081 83[.]138[.]53[.]110 8c5b72906e8183037532afc3f4639931 blackpointcyber[.]com CVE-2026-35616 d91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383a fd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5 horizon3[.]ai hxxp://83[.]138[.]53[.]110/dl/p[.]exehxxp://83[.]138[.]53[.]110/service/save[.]phphxxps://blackpointcyber[.]com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/hxxps://horizon3[.]ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/hxxps://simple-help[.]com/release-newshxxps://simple-help[.]com/security/simplehelp-security-update-2026-05simple-help[.]com
Browse all indicators → Machine-readable feeds → Extract IOCs from text →