As reported by The Hacker News, Securonix researchers have published details on TASK#STOMP, a PowerShell backdoor campaign that harvests documents, Wi-Fi credentials, clipboard data, and screenshots from compromised Windows hosts. The campaign is notable not for novel exploit techniques but for its disciplined operational tradecraft — and that is precisely what makes it dangerous.

Threat Alert: As reported by The Hacker News, Securonix researchers have published details on TASK#STOMP, a PowerShell backdoor campaign that harvests documents, Wi-Fi credentials, clipboard data, and screenshots from compromised Windows hosts.

Why This Matters

TASK#STOMP exemplifies a persistent and growing class of fileless, living-off-the-land (LotL) threats that weaponize native Windows tooling — VBScript, PowerShell, scheduled tasks, and the Startup folder — to maintain persistence without dropping traditional binaries. Because every component is a legitimate OS feature, signature-based AV and endpoint tools operating in default configurations frequently miss this activity or drown it in noise.

The campaign's use of redundant persistence is especially concerning. By deploying both scheduled tasks with benign-sounding names (Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler) and a Startup folder fallback (msdiag.vbs), the operators ensure survivability even if one mechanism is discovered and removed. The dual C2 architecture — two token-authenticated channels via sys_loader.ps1 and win_conn.ps1 — means defenders must identify and neutralize both to fully evict the actor.

The combination of timestomping, hidden execution, process separation, and cleanup behavior signals a mature operator who has anticipated forensic response and built countermeasures into the implant itself.

Who Is at Risk

Who Is at Risk
Windows-dominant enterprise environments where PowerShell execution is broadly permitted and endpoint detection is configured to log but not block suspicious script behavior.
SMBs and mid-size organizations that rely on default AV without EDR or behavioral analytics.
Environments with weak email filtering, as the suspected initial access vector is phishing or social engineering delivering the encoded VBScript dropper.
Users handling sensitive documents locally — the real-time filesystem watcher means any new file saved to the host is immediately staged for exfiltration.

Broader Implications

The clipboard-harvesting and Wi-Fi credential theft capabilities extend the blast radius beyond the compromised host. Stolen Wi-Fi profiles can provide initial access to corporate networks if the victim's machine connects to infrastructure from remote locations. Clipboard capture is particularly dangerous for users who copy credentials, MFA codes, or cryptocurrency keys — a single compromised session can yield access to password managers, banking portals, and administrative consoles.

The choice to run collection and C2 modules as separate PowerShell processes is a deliberate resilience strategy. If defenders kill one process, the other maintains access — and the implant can re-spawn its twin. This design forces defenders to conduct thorough host forensics rather than simply terminating a suspicious process.

Shield53 Recommendations

Immediate Detection Actions

  • Hunt for scheduled tasks with masqueraded names: Query all endpoints for tasks named Local Credential Manager, Network Audio Service, Windows Display Manager, or Device Credential Handler. These are not native Windows task names.
  • Search for indicator files: Look for 95c9050t66.vbs, msdiag.vbs, sys_loader.ps1, win_conn.ps1, diag_pack.dat, and win_conn_cfg.dat across your estate.
  • Correlate wscript.exe launching PowerShell: This is an unusual parent-child process chain. Alert on wscript.exe spawning powershell.exe with encoded command arguments.
  • Audit Startup folder contents: Enumerate files in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ across all endpoints for unexpected VBS or script files.

Hardening Measures

  • Enforce Constrained Language Mode for non-admin PowerShell sessions to limit what injected scripts can accomplish.
  • Deploy PowerShell Script Block Logging (Event ID 4104) and Script Execution logging (Event ID 4103) — these capture the full decoded content of obfuscated scripts, which is critical for forensic reconstruction.
  • Enable ASR rules — specifically the rule blocking execution of obfuscated scripts and the rule blocking process creations from WMI and PowerShell — to disrupt this exact attack chain.
  • Restrict wscript.exe and cscript.exe execution for standard users via AppLocker or WDAC where feasible.
  • Disable Wi-Fi auto-connect profiles on corporate assets and purge stored Wi-Fi credentials using netsh wlan delete profile for non-corporate SSIDs.

Investigation Guidance

If a compromise is confirmed, do not simply terminate the suspicious PowerShell processes. Treat the host as fully compromised: capture volatile memory, preserve the scheduled task XML definitions, and examine the diag_pack.dat and win_conn_cfg.dat files for decoded C2 infrastructure. Both C2 channels must be identified and blocked at the perimeter — not just one — or the actor will maintain access through the redundant path.