[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD3yU0v2CagurXCeNGqZYGT6T455bcJ6p6lLcVGoDR6U":3},{"article":4,"iocs":41,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"a1c40ef8-3dbb-485b-b22d-810a33bb7331","TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data","task-stomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-da-f38e75","Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor \"automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary","A new campaign named TASK#STOMP utilizes a PowerShell backdoor to steal sensitive data including business documents, Wi-Fi passwords, and clipboard contents. The malware employs multiple persistence techniques, modifies timestamps, and uses redundant C2 servers to evade detection and complicate forensic analysis. Researchers suspect initial access may be via phishing or social engineering.","TASK#STOMP PowerShell backdoor steals documents, Wi-Fi passwords, and clipboard data.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftaskstomp-powershell-backdoor-steals.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhC3vJ8DX6852JxHepz1kGmunH3ZXsStcK4LINkLBCrzS8ZacBhqL-7epmGuzSNGI-jpF4GtkM-FXUsrv3croTLimjG_SBbw-rpO8NBIHf6Wvr6BMmYYSDKxEPQI-nrSFYrc9vmojcKn50LRFbc1t3h8qFA8dE_pZ3kMvelRpBFVFe2ZmCVJhPCWlMxYZpO\u002Fs1600\u002Fstomp.jpg","2026-09-21T14:15:40+00:00","2026-09-21T16:00:08.957325+00:00",8,[17,20,23,25],{"name":18,"type":19},"TASK#STOMP","campaign",{"name":21,"type":22},"PowerShell","technology",{"name":24,"type":22},"VBScript",{"name":26,"type":27},"Google Chrome","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,36],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,48],{"type":43,"value":44,"context":45},"domain","corecloudfileshare[.]xyz","Command and Control (C2) server",{"type":43,"value":47,"context":45},"attachmentsharingdrive[.]xyz",{"type":43,"value":49,"context":50},"irantenders[.]com","URL accessed by malware, purpose unknown",[26],{"controls":53,"vendors":138},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":84,"name":85,"problem":86,"products":87},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":113,"name":114,"problem":115,"products":116},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[117,122,130],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":118,"product_name":119,"url":120,"description":121},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":158},"powershell-backdoor-taskstomp-exfiltrates-sensitive-data-via-phishing","PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing","The TASK#STOMP campaign demonstrates how a well-crafted phishing or social engineering lure can provide attackers with a foothold to deploy a sophisticated PowerShell backdoor capable of harvesting documents, Wi-Fi credentials, and clipboard data. The malware's use of timestamp manipulation and redundant C2 servers is designed to frustrate forensic investigators and extend dwell time — meaning breaches may go undetected for extended periods. Clipboard theft is particularly dangerous as it can silently capture passwords, MFA codes, and financial data that users copy during routine activity. This attack highlights that even well-resourced organizations remain vulnerable when users are not trained to recognize social engineering tactics and when endpoint telemetry is insufficient to catch malicious PowerShell activity early.",[144,145,146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 IR-5: Incident Monitoring","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1115: Clipboard Data","MITRE ATT&CK T1070.006: Timestomp","GDPR Article 32: Security of Processing","NIST CSF DE.CM-1: Network Monitoring",{}]