Cybersecurity Threat Analysis | September 21, 2026

A newly discovered malware campaign, tracked as TASK#STOMP, highlights how attackers are exploiting legitimate Windows utilities to establish persistent access, steal confidential business information and evade traditional security controls.

According to research, the PowerShell-based backdoor can steal business documents, extract saved Wi-Fi passwords, monitor clipboard contents, capture screenshots and execute commands received from remote attackers.

What makes TASK#STOMP particularly concerning is its ability to continuously monitor the filesystem and automatically steal newly created or modified documents.

This means that a single infected workstation can become a persistent source of confidential business information leakage.

1. How TASK#STOMP Works

The observed attack begins with a malicious VBScript file executed through wscript.exe, a legitimate Windows utility.

The initial delivery method has not been confirmed. Once executed, the malware establishes persistence through four scheduled tasks disguised as Windows services and an additional script placed in the Windows Startup folder.

It then launches two PowerShell components:

  • sys_loader.ps1: Performs document collection, credential theft, clipboard monitoring, screenshot capture and remote command execution.

  • win_conn.ps1: Provides a secondary command-and-control channel and additional collection functionality.

The components contain code intended to restart each other if one stops, although researchers identified implementation flaws that limit some of this functionality.

The malware also employs timestamp manipulation and cleanup techniques to complicate forensic analysis.

These capabilities make it important for organisations to investigate the complete infection rather than simply terminating a suspicious PowerShell process.

2. Continuous Document Theft: A Serious Risk to Businesses

TASK#STOMP searches for business documents, including Microsoft Word files, Excel spreadsheets, PowerPoint presentations and PDFs.

Unlike malware that performs a one-time collection of files, TASK#STOMP can monitor directories and steal newly created or modified documents.

This creates a significant threat to organisations handling confidential information.

Potentially exposed information could include customer contracts, financial statements, tender documents, intellectual property, business strategies, technical designs and proprietary research.

For example, a compromised workstation belonging to a sales employee could expose customer proposals and commercial agreements. An infected engineering workstation could potentially disclose confidential product documentation.

The consequences depend on the documents actually accessible to the infected system.

The important distinction is that the risk does not end after the initial infection. As long as the malware remains active, newly created sensitive information may continue to be exposed.

3. Wi-Fi Password Theft and Clipboard Monitoring Expand the Threat

TASK#STOMP also collects saved Wi-Fi passwords and monitors clipboard contents.

The theft of Wi-Fi credentials can expose corporate wireless networks, particularly where organisations rely on shared passwords.

Clipboard monitoring introduces another serious risk because employees routinely copy passwords, authentication tokens, confidential information and other sensitive data during their work.

Screenshot capture allows attackers to collect information displayed on the screen, while remote command execution enables additional malicious activity.

Together, these capabilities make TASK#STOMP more than a simple document stealer.

It is a remote-access backdoor that can provide attackers with ongoing visibility into an infected user's activities.

4. Why Multiple Persistence Mechanisms Make Removal Difficult

One of the distinctive characteristics of TASK#STOMP is its use of multiple persistence mechanisms.

The malware creates four scheduled tasks and places an additional script in the Startup folder.

Consequently, deleting one malicious file or stopping one PowerShell process may not eliminate the infection.

Another component could remain capable of restarting malicious activity.

Security teams must examine scheduled tasks, Startup entries, suspicious PowerShell scripts, associated processes and network communications.

Where compromise is confirmed, rebuilding the affected workstation from a trusted image may be necessary.

A successful malware removal procedure must eliminate every persistence mechanism and assess whether attackers have already stolen credentials or confidential information.

5. What Organisations Should Do to Prevent TASK#STOMP Attacks

Organisations should implement a layered security strategy covering malicious execution, persistence, sensitive file access and data exfiltration.

Strengthen endpoint security: Deploy endpoint detection and response capabilities to identify suspicious PowerShell and VBScript execution, unexpected scheduled-task creation and unusual process relationships.

Implement Data Loss Prevention: Monitor unauthorised access to sensitive business documents and suspicious attempts to transfer them outside the organisation. Context-aware policies can consider the sensitivity of files, user activity, destinations and unusual transfer volumes.

Monitor network communication: Use firewalls, intrusion prevention systems, DNS security and network telemetry to identify communication with known malicious infrastructure and investigate unusual outbound data transfers.

Restrict unnecessary scripting: Apply application control policies and limit Windows Script Host and PowerShell execution where operationally practical. Legitimate administrative activity should be distinguished from suspicious script behaviour.

Protect corporate Wi-Fi credentials: Use individual authentication and certificate-based access where appropriate, rather than relying exclusively on shared wireless passwords.

Monitor persistence mechanisms: Investigate unexpected scheduled tasks and Startup folder modifications, particularly when they launch scripts from unusual directories.

Endpoint security and network monitoring should be correlated to identify the full attack sequence, from initial script execution to document collection and exfiltration.

6. What Should Companies Do If TASK#STOMP Is Detected?

Organisations identifying a suspected infection should immediately initiate their incident-response procedures.

The affected workstation should be isolated while relevant forensic evidence is preserved.

Investigators should identify all persistence mechanisms, determine which documents were accessed and review potential data exfiltration.

Potentially exposed passwords, Wi-Fi credentials and authentication tokens should be revoked or rotated where appropriate.

Other endpoints should be examined for related suspicious activity.

Where compromise is confirmed, organisations should consider rebuilding the affected workstation from a trusted image.

Most importantly, incident response should not end with malware removal. It must also establish whether confidential customer, employee or business information was stolen.

7. The Bigger Cybersecurity Lesson: Detect Data Theft, Not Just Malware

TASK#STOMP demonstrates that attackers do not always require sophisticated exploits or custom executable files to compromise an organisation.

Legitimate Windows utilities such as PowerShell, Windows Script Host and Task Scheduler can be combined to establish persistence, execute commands and steal sensitive information.

Individually, these tools may appear legitimate.

However, a sequence involving suspicious script execution, multiple scheduled tasks, bulk document collection and unexpected outbound connections can indicate malicious activity.

This is why organisations must move beyond relying exclusively on malware signatures and known malicious file hashes.

Security solutions should correlate endpoint behaviour, access to sensitive documents and network activity to identify potential information theft.

Conclusion

TASK#STOMP highlights the growing threat of persistent, script-based malware designed to steal confidential business information.

Its ability to continuously harvest documents, extract Wi-Fi credentials, monitor clipboard contents and maintain remote access makes it a serious concern for organisations handling sensitive data.

Effective protection requires endpoint security, behavioural monitoring, network threat detection, Data Loss Prevention and comprehensive incident-response procedures.

The key takeaway: A compromised workstation is not merely an infected device. When malware continuously monitors and steals business documents, it becomes an ongoing channel for confidential data leakage. Organisations must protect not only their systems but also the sensitive information being accessed, collected and transmitted.

Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary

Source: TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data via The Hacker News — published 21 Sep 2026.