A new PowerShell backdoor called TASK#STOMP actively harvests documents, Wi-Fi credentials, and clipboard data from compromised systems, according to cybersecurity researchers who disclosed the threat campaign this week.
The backdoor operates with persistent surveillance capabilities. It automatically extracts business documents from infected machines while monitoring the filesystem in real time for new files. The malware intercepts Wi-Fi passwords stored on the host, captures clipboard contents, takes screenshots, and executes arbitrary commands sent by attackers. This combination of features positions TASK#STOMP as a multi-purpose reconnaissance and data theft tool.
PowerShell backdoors remain popular infection vectors because Windows includes PowerShell as a built-in component. Attackers exploit this native tool to avoid triggering endpoint detection and response (EDR) systems that typically focus on non-native binaries. TASK#STOMP follows this pattern by leveraging PowerShell's scripting capabilities to establish persistent access and perform extensive data exfiltration.
The threat actor behind TASK#STOMP deploys the backdoor through initial compromise vectors that researchers did not detail in the disclosed information. Once installed, the malware maintains continuous surveillance of target systems. The real-time filesystem monitoring differentiates this backdoor from simpler variants that only steal data on demand. This approach ensures attackers capture sensitive documents immediately after creation or modification.
Wi-Fi password theft presents particular risk to organizations. Attackers gain access to network credentials that employees store on their devices, potentially enabling lateral movement into corporate networks or access to guest networks that connect to internal resources. Clipboard harvesting captures passwords, authentication tokens, API keys, and other secrets that users temporarily store while working.
The screenshot capability combined with document theft creates a comprehensive view of user activity. Attackers receive visual confirmation of what appears on screen alongside the actual files being accessed. This layered approach to intelligence gathering gives threat actors detailed operational context about target organizations.
Organizations affected by TASK#STOMP face multiple risks. Competitor intelligence leakage exposes strategic business documents. Stolen credentials enable further network compromise. Clipboard harvesting intercepts sensitive information during routine work tasks. The combination creates exposure across confidentiality, integrity, and availability of critical systems.
Detection requires monitoring PowerShell execution logs for suspicious script activity. Organizations should implement application whitelisting to restrict PowerShell script execution to approved scripts only. Network-level monitoring of outbound connections from systems can identify exfiltration attempts. Endpoint detection and response solutions should track filesystem monitoring activity and credential access patterns.
Defensive measures include restricting PowerShell to authorized administrators only, disabling unused remote management features, and enforcing multi-factor authentication across critical systems. Regular patching closes exploitation pathways that initial compromise attempts may leverage. User training on phishing and credential security reduces successful initial access attempts.
The TASK#STOMP campaign demonstrates how attackers leverage built-in operating system features to establish persistent access while remaining below detection thresholds. Organizations must assume that Windows-based systems face this threat and implement corresponding detection and prevention controls accordingly.