{"id":3020,"date":"2026-09-21T16:32:24","date_gmt":"2026-09-21T16:32:24","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3020"},"modified":"2026-09-21T16:32:24","modified_gmt":"2026-09-21T16:32:24","slug":"taskstomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-data","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3020","title":{"rendered":"TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 21, 2026<\/span><\/span>Endpoint Security \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP<\/strong> that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts.<\/p>\n

The backdoor \u00abautomatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary remote commands through two redundant, token-authenticated C2 servers,\u00bb Securonix researchers Akshay Gaikwad and Aaron Beardslee said<\/a> in a report shared with The Hacker News.<\/p>\n

The starting point of the infection chain is the use of \u00abwscript.exe\u00bb to execute an encoded Visual Basic Script (VBScript) file staged on the victim’s desktop (\u00ab95c9050t66.vbs\u00bb). The exact initial access pathway used to deliver the payload is unclear, although it’s possible that it may have been via email-based phishing or social engineering.<\/p>\n

By giving it a completely random file name, it’s suspected that the intention may have been to evade file name-based detection mechanisms. The VBScript functions as the orchestrator for establishing persistence on the host using scheduled tasks and launching subsequent stages.<\/p>\n

The tasks are given the names Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler so as to blend in with regular operating system activity and avoid raising any red flags.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The VBScript installer also sets up a backup persistence method that uses the Windows Startup folder to launch another script payload (\u00abmsdiag.vbs\u00bb) every time the user logs in to the system. In the next phase, the malware executes PowerShell commands to forcibly terminate previously running instances and ensure there exists only one active session <\/p>\n

<\/p>\n

These strategies, paired with deliberate timestamp modification (aka timestomping), hidden execution, and cleanup behavior, suggest a deliberate effort to get around superficial administrative reviews and complicate forensic analysis. The use of redundant persistence methods guarantees continued execution even if one of them fails or is detected and removed.<\/p>\n

\"\"<\/a><\/div>\n

The next phase involves running a pair of hidden PowerShell commands –<\/p>\n