TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

The TASK#STOMP campaign delivers a PowerShell-based backdoor that steals business documents, Wi-Fi passwords, clipboard contents, and screenshots while enabling remote command execution. The infection begins with a malicious VBScript file ('95c9050t66.vbs') executed via wscript.exe, which establishes persistence through scheduled tasks and the Windows Startup folder. The malware uses two redundant PowerShell modules—sys_loader.ps1 and win_conn.ps1—that communicate with C2 domains corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, and maintain mutual watchdog functionality to ensure persistence. The attack leverages living-off-the-land techniques, including encoded scripts, timestomping, and abuse of native Windows components to evade detection.

AI-extracted · verify before operational use