New TASK#STOMP Windows Backdoor Enables Continuous Document Theft
New TASK#STOMP Windows backdoor steals documents and maintains remote access.
A new sophisticated Windows backdoor, dubbed TASK#STOMP, has been identified that leverages PowerShell and scheduled tasks for persistent access and remote control. It employs runtime C# compilation to evade detection and is designed to continuously exfiltrate sensitive business documents.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonTASK#STOMP exploits Windows scheduled tasks and PowerShell — two built-in, trusted system components — to establish persistent access and continuously exfiltrate sensitive business documents without triggering standard defenses. By compiling C# code at runtime, the malware evades signature-based detection, making traditional antivirus solutions insufficient. This attack highlights the danger of leaving PowerShell unrestricted and scheduled task creation unmonitored in enterprise environments. The continuous, automated nature of the document theft means that even a brief window of undetected access can result in significant data loss with long-term business consequences.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TASK#STOMP