Threat Intelligence

New TASK#STOMP Malware Campaign Steals Documents, Wi-Fi Passwords and Clipboard Data

The Hacker News · 22 Sept 2026

Key Takeaway Regularly review scheduled tasks and startup items for unfamiliar entries, and train staff to recognise phishing attempts, since this backdoor relies on deceptive persistence techniques that can go unnoticed during routine checks.

Security researchers at Securonix have detailed a campaign named TASK#STOMP that deploys a PowerShell-based backdoor capable of stealing sensitive data from infected computers. Once active, it harvests business documents, monitors the file system for new files, steals Wi-Fi passwords and clipboard contents, takes screenshots, and can accept remote commands from two backup command-and-control servers.

The infection begins with a randomly named VBScript file being run via wscript.exe, though researchers have not confirmed the exact delivery method, noting phishing or social engineering as likely possibilities. The script sets up persistence using scheduled tasks disguised with legitimate-sounding names such as 'Local Credential Manager' and 'Windows Display Manager' to blend in with normal system activity. A backup mechanism also launches a secondary script from the Windows Startup folder each time a user logs in.

The malware further manipulates file timestamps and runs hidden PowerShell processes to complicate detection and forensic investigation. Researchers note that running components as separate processes gives the attackers operational redundancy, meaning that stopping one part of the malware does not necessarily disable the whole infection.

malware PowerShell data theft persistence techniques phishing

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.