Cybersecurity researchers have uncovered a sophisticated backdoor, dubbed “TASK#STOMP,” which has been lurking in PowerShell environments on Windows systems. This malicious tool allows attackers to quietly extract sensitive information, including documents, Wi-Fi passwords, and clipboard data, from compromised machines.
The impact is significant: TASK#STOMP has been identified as a key component of an attack chain that exploits identity exposure and privilege escalation vulnerabilities. By leveraging these weaknesses, attackers can create active attack paths, essentially setting up a roadmap for further exploitation. This means that organizations with lax access controls or poor password management practices are particularly vulnerable to this type of threat.
TASK#STOMP operates by exploiting the PowerShell scripting engine on Windows systems. It does so through a series of steps: first, it injects itself into an existing process; next, it creates a hidden thread to monitor and collect sensitive data; finally, it exfiltrates this information back to the attacker’s command and control (C2) server. The malicious code is designed to evade detection by security software, making it difficult for defenders to spot.
The fact that TASK#STOMP can access clipboard data raises particular concerns about data theft. Attackers can use this capability to extract sensitive information such as login credentials or credit card numbers. Furthermore, the ability to steal Wi-Fi passwords allows attackers to pivot between networks and expand their attack surface. This is especially worrying in environments where users share devices or rely on public hotspots.
Researchers have noted that TASK#STOMP’s design bears some similarities to other malware families, suggesting a possible connection between different threat actors. However, the exact origins of this backdoor remain unclear at this time. What is certain, though, is that organizations need to take immediate action to protect themselves against these types of threats.
To mitigate the risks associated with TASK#STOMP and similar attacks, we recommend that security teams focus on three key areas: first, implement robust access controls and password management practices; second, conduct regular vulnerability assessments to identify potential entry points for attackers; third, keep software up-to-date, including PowerShell, to prevent exploitation of known weaknesses. By taking these steps, organizations can reduce their exposure to sophisticated attacks like TASK#STOMP and stay ahead of evolving threats in the cyber landscape.
Source: The Hacker News — 2026-09-21