A sophisticated PowerShell backdoor has been discovered, allowing attackers to remotely steal sensitive information from compromised Windows systems. Dubbed “TASK#STOMP,” this malware is being used in targeted attacks against individuals and organizations worldwide.
The malware uses a combination of legitimate tools and social engineering tactics to gain access to victims’ machines. First, an attacker sends a phishing email or message that tricks the victim into running a PowerShell script. This script then downloads and installs TASK#STOMP, which establishes a persistent backdoor on the system. Once inside, the malware uses Windows Management Instrumentation (WMI) to scan for sensitive information, including documents, Wi-Fi passwords, and clipboard data.
But how does this work? Simply put, WMI is a built-in Windows feature that allows administrators to remotely manage and monitor systems. Attackers are exploiting this capability by using TASK#STOMP to query WMI repositories on compromised machines, essentially giving them a treasure trove of sensitive information at their fingertips. The malware also steals Wi-Fi passwords, which can be used to spread the infection further or gain unauthorized access to other networks.
The affected parties in these attacks appear to be individuals and organizations with weak security practices, making them easy targets for hackers. It’s essential to note that TASK#STOMP is not a zero-day exploit, meaning it relies on known vulnerabilities rather than exploiting unpatched code. This makes prevention easier – users just need to keep their systems up-to-date and avoid suspicious emails or messages.
The fact that this malware can steal clipboard data highlights the importance of good cybersecurity hygiene. Attackers often use stolen information for social engineering attacks, such as phishing or business email compromise (BEC). To protect yourself from these types of threats, make sure your system is running the latest Windows updates and consider implementing a reputable antivirus solution. Also, be cautious when opening attachments or clicking on links from unknown sources – they could be malicious.
In conclusion, TASK#STOMP’s ability to steal sensitive information using WMI underscores the importance of robust cybersecurity measures. While this malware is complex and sophisticated, it relies on exploiting known vulnerabilities. By staying informed about potential threats and taking proactive steps to secure your system, you can significantly reduce the risk of falling victim to an attack like this.
Source: The Hacker News — 2026-09-21