TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
TASK#STOMP PowerShell backdoor steals documents, Wi-Fi passwords, and clipboard data.
A new campaign named TASK#STOMP utilizes a PowerShell backdoor to steal sensitive data including business documents, Wi-Fi passwords, and clipboard contents. The malware employs multiple persistence techniques, modifies timestamps, and uses redundant C2 servers to evade detection and complicate forensic analysis. Researchers suspect initial access may be via phishing or social engineering.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google Chrome?
Get an email when a new story names Google Chrome, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe TASK#STOMP campaign demonstrates how a well-crafted phishing or social engineering lure can provide attackers with a foothold to deploy a sophisticated PowerShell backdoor capable of harvesting documents, Wi-Fi credentials, and clipboard data. The malware's use of timestamp manipulation and redundant C2 servers is designed to frustrate forensic investigators and extend dwell time — meaning breaches may go undetected for extended periods. Clipboard theft is particularly dangerous as it can silently capture passwords, MFA codes, and financial data that users copy during routine activity. This attack highlights that even well-resourced organizations remain vulnerable when users are not trained to recognize social engineering tactics and when endpoint telemetry is insufficient to catch malicious PowerShell activity early.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — corecloudfileshare[.]xyz
- domain — attachmentsharingdrive[.]xyz
- domain — irantenders[.]com