PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing
Written by AI from the linked story. Not reviewed by an editor. How this works
The TASK#STOMP campaign demonstrates how a well-crafted phishing or social engineering lure can provide attackers with a foothold to deploy a sophisticated PowerShell backdoor capable of harvesting documents, Wi-Fi credentials, and clipboard data. The malware's use of timestamp manipulation and redundant C2 servers is designed to frustrate forensic investigators and extend dwell time — meaning breaches may go undetected for extended periods. Clipboard theft is particularly dangerous as it can silently capture passwords, MFA codes, and financial data that users copy during routine activity. This attack highlights that even well-resourced organizations remain vulnerable when users are not trained to recognize social engineering tactics and when endpoint telemetry is insufficient to catch malicious PowerShell activity early.
Tactical Insight
Immediate actions
- Deploy PowerShell Constrained Language Mode and script block logging to detect and limit malicious PowerShell execution.
- Audit and restrict clipboard access permissions for non-essential applications on endpoints handling sensitive data.
- Block or alert on outbound connections to unknown or newly registered domains commonly used as C2 infrastructure.
Long-term improvements
- Implement a phishing-resistant MFA solution and conduct regular social engineering awareness training for all staff.
- Enforce application whitelisting to prevent unauthorized scripts and binaries from executing on endpoints.
- Establish a formal data classification and exfiltration prevention (DLP) program to monitor and block unauthorized data transfers.
Detection measures
- Enable comprehensive endpoint detection and response (EDR) telemetry, specifically monitoring for timestamp modification (timestomping) as an indicator of anti-forensic activity.
- Correlate SIEM alerts for anomalous PowerShell invocations, lateral movement, and repeated C2 beacon patterns across multiple hosts.
- Conduct regular threat hunting exercises focused on persistence mechanisms such as scheduled tasks, registry run keys, and WMI subscriptions.