TASK#STOMP Power Shell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Summary: Securonix researchers Akshay Gaikwad and Aaron Beardslee disclosed a campaign called TASK#STOMP that uses an encoded VBScript file on the victim's desktop to install a PowerShell backdoor which harvests business documents, watches the filesystem for new files, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts remote commands through two token-authenticated C2 servers at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. The VBScript establishes persistence through scheduled tasks named Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, plus a backup Startup folder script (msdiag.vbs), while two hidden PowerShell modules act as mutual watchdogs that restart each other if one stops running.
What you should know: The operation relies almost entirely on native Windows components - Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain - so individual events look like benign administrative activity, and its redundant persistence means removing one anchor does not stop the backdoor.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026