TaskWeaver

First Observed: June 21, 2026

Threat Type: Loader

Platform: Windows

Confidence: High

Aliases and Related Activity:

• Associated with Djinn Stealer
• Observed following exploitation of SimpleHelp vulnerability CVE-2026-48558

TaskWeaver is a modular, heavily obfuscated Node.js malware loader identified by the Blackpoint Adversary Pursuit Group (APG). It is designed to fingerprint compromised systems, establish encrypted command and control (C2) communications, and retrieve and execute additional payloads.

Rather than embedding a fixed set of post-exploitation capabilities, TaskWeaver functions as a reusable delivery framework capable of deploying follow-on malware such as information stealers while leveraging the trusted Node.js runtime to blend in with legitimate developer activity.

Blackpoint researchers have observed TaskWeaver in activity associated with Djinn Stealer and following exploitation of the SimpleHelp vulnerability CVE-2026-48558. Its modular design and use of a legitimate JavaScript runtime provide operators with a flexible mechanism for executing additional malicious payloads within compromised Windows environments.

TaskWeaver activity incorporates several techniques mapped to the MITRE ATT&CK framework, including JavaScript execution, obfuscation, masquerading, system information discovery, and command-and-control traffic over web protocols.

Blackpoint APG observed TaskWeaver working alongside additional tooling and legitimate software abused during the intrusion chain.

Organizations investigating potential TaskWeaver activity should review the following execution patterns, file indicators, network infrastructure, and URI behavior identified by Blackpoint APG.

• Apply application control and restrict or monitor the execution of Node.js (node.exe) on systems where it is not operationally required.
• Monitor for abnormal outbound HTTPS communications initiated by node.exe, particularly to newly observed or low-reputation domains.
• Limit remote management software access using least-privilege principles and multi-factor authentication (MFA), and regularly audit technician accounts for unauthorized activity.
• Place administrative interfaces behind a VPN or identity-aware proxy and enforce phishing-resistant MFA, source restrictions, and dedicated administrative workstations.
• Restrict temporary tunneling services, such as trycloudflare[.]com, when not required.

For a deeper analysis of the intrusion chain and malware behavior, read Blackpoint Cyber’s A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain.