New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords

TASK#STOMP is a newly analyzed Windows backdoor that turns ordinary built-in tools into a durable spying operation.

It uses a Visual Basic Script installer, hidden PowerShell, scheduled tasks, and runtime code compilation to collect business documents, saved Wi-Fi passwords, clipboard data, and screenshots from compromised machines.

The observed infection begins with a randomly named VBS file in a user-accessible location. Its delivery route remains unconfirmed: the available evidence cannot distinguish phishing, a browser download, removable media, remote access, or an extracted archive. Once launched, the script builds several ways to survive a restart or partial cleanup.

Securonix said in a report shared with Cyber Security News (CSN) that its analysts decoded the final payloads and identified TASK#STOMP as a fully working PowerShell backdoor.

The research shows the operation is built for continued collection and remote control, rather than an immediately destructive attack.

That combination raises the risk for organizations holding sensitive files. Attackers can search every fixed drive for recent documents and archives, then keep watching for new or changed files.

The backdoor also accepts commands from its operators, leaving an infected computer open to further theft, additional malware, or disruptive actions. It also gathers system and network details for registration.

New TASK#STOMP Backdoor Uses PowerShell

The main module searches fixed drives for Word, PDF, PowerPoint, Excel, and archive files. It favors documents created or changed during the past year, skips files larger than 500 MB, and uploads selected material to its command servers.

A file watcher then monitors drives so later changes can be taken too. It also runs Windows netsh commands to list stored wireless profiles and expose their saved keys in plain text.

Clipboard content is copied, sent out, and cleared, while screenshots of the main display can be captured on command. These functions make TASK#STOMP a broad data-collection tool, similar to the credential-harvesting behavior discussed in Wi-Fi credential theft campaigns.

Two separate PowerShell branches divide the workload. One decodes the document-stealing payload, while the other maintains a second command channel with overlapping capabilities.

They can restart each other, and their servers fail over if one connection fails, helping the operator keep access when a process or network route is interrupted. The malware hides its network traffic behind a Chrome-like user agent and compiles small C# helpers within PowerShell.

Those helpers accept invalid TLS certificates, which can let the backdoor reach its servers even when certificate checks would normally stop the connection. The activity resembles other cases where PowerShell scripts deliver backdoors through native Windows components.

Persistence and Response Priorities

TASK#STOMP establishes four scheduled tasks from XML files stored under a user-writable AppData folder, then drops msdiag.vbs in the Startup folder.

The tasks use rotating names that resemble Windows services, making a quick review less reliable. This technique closely reflects the abuse covered in Windows task persistence techniques, where trusted scheduling features are turned into a long-term foothold.

Before relaunching its modules, the script ends earlier instances, changes several file timestamps to January 15, 2024, and starts PowerShell with hidden-window and execution-policy-bypass settings.

Both PowerShell processes then launch the legitimate C# compiler, csc.exe. This full sequence is far more useful to defenders than one filename or task name alone.

Security teams should investigate VBS or Windows Script Host processes that create tasks from AppData, especially when they are followed by hidden PowerShell and compiler activity.

PowerShell Script Block Logging, AMSI records, Task Scheduler logs, and endpoint file events can preserve the commands and temporary files needed to reconstruct the chain.

Comparable hidden PowerShell persistence activity has also shown why native tool misuse needs behavioral detection. Containment must be coordinated.

Teams should preserve task XML and staged files, stop active VBS and PowerShell processes, remove every scheduled task and Startup entry, block the confirmed infrastructure, and reboot to confirm nothing returns. Removing only one script or task may allow the remaining components to rebuild the infection.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords appeared first on Cyber Security News.