[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA3U5usZFo25K-uOsDW2UTgEufi0ZZJGDCuEj1V65WHA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"d5be13fb-0588-4d8d-b508-87c5f22f833b","powershell-backdoor-taskstomp-exfiltrates-sensitive-data-via-phishing","a1c40ef8-3dbb-485b-b22d-810a33bb7331","PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing","The TASK#STOMP campaign demonstrates how a well-crafted phishing or social engineering lure can provide attackers with a foothold to deploy a sophisticated PowerShell backdoor capable of harvesting documents, Wi-Fi credentials, and clipboard data. The malware's use of timestamp manipulation and redundant C2 servers is designed to frustrate forensic investigators and extend dwell time — meaning breaches may go undetected for extended periods. Clipboard theft is particularly dangerous as it can silently capture passwords, MFA codes, and financial data that users copy during routine activity. This attack highlights that even well-resourced organizations remain vulnerable when users are not trained to recognize social engineering tactics and when endpoint telemetry is insufficient to catch malicious PowerShell activity early.","**Immediate actions:**\n- Deploy PowerShell Constrained Language Mode and script block logging to detect and limit malicious PowerShell execution.\n- Audit and restrict clipboard access permissions for non-essential applications on endpoints handling sensitive data.\n- Block or alert on outbound connections to unknown or newly registered domains commonly used as C2 infrastructure.\n\n**Long-term improvements:**\n- Implement a phishing-resistant MFA solution and conduct regular social engineering awareness training for all staff.\n- Enforce application whitelisting to prevent unauthorized scripts and binaries from executing on endpoints.\n- Establish a formal data classification and exfiltration prevention (DLP) program to monitor and block unauthorized data transfers.\n\n**Detection measures:**\n- Enable comprehensive endpoint detection and response (EDR) telemetry, specifically monitoring for timestamp modification (timestomping) as an indicator of anti-forensic activity.\n- Correlate SIEM alerts for anomalous PowerShell invocations, lateral movement, and repeated C2 beacon patterns across multiple hosts.\n- Conduct regular threat hunting exercises focused on persistence mechanisms such as scheduled tasks, registry run keys, and WMI subscriptions.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 IR-5: Incident Monitoring","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1115: Clipboard Data","MITRE ATT&CK T1070.006: Timestomp","GDPR Article 32: Security of Processing","NIST CSF DE.CM-1: Network Monitoring",{},"published","2026-09-21T16:21:38.598673+00:00","2026-09-21T16:21:38.292+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftaskstomp-powershell-backdoor-steals.html","task-stomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-da-f38e75","TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":64,"name":65,"problem":66},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]