The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp.
A vulnerability in the popular Ultimate Member WordPress plugin enables account takeover by exposing password reset links.