TASK#STOMP Malware Steals Wi-Fi Passwords and Live Documents

A new cyber threat known as TASK#STOMP is actively compromising Windows systems to steal sensitive business information. The malware operates as a persistent backdoor that continuously monitors file activity, captures clipboard content, and exfiltrates business documents. It also harvests Wi-Fi passwords and takes screenshots of the victim's screen without their knowledge.

Researchers from Securonix detailed the attack chain in a report shared with The Hacker News. The infection begins with a randomly named Visual Basic Script file placed on the desktop. This script establishes persistence by creating scheduled tasks disguised as standard system services, such as a Network Audio Service, to avoid detection. It also places a secondary script in the Windows Startup folder to ensure the malware relaunches upon every user login.

Dual modules ensure continuous data theft

The core functionality relies on two separate PowerShell modules that operate in tandem. One module handles the actual data collection, including reading documents and monitoring the filesystem for newly created files in real time. The other module manages the communication channel with the command-and-control server. This redundancy is a key trade-off: if one module is terminated or fails, the other remains active, ensuring the attackers maintain access.

These modules also act as mutual watchdogs, restarting each other if they detect that the partner process has stopped. They communicate with two specific domains to send stolen data and receive instructions. This design makes it difficult for defenders to fully remove the threat, as eliminating one component often leaves the other running to re-establish the connection.

Obscure behaviors complicate forensic analysis

The attackers employ several techniques to hide their presence and complicate forensic analysis. The malware modifies file timestamps to make the malicious files appear as if they were created long before the infection. It also uses hidden execution methods and performs cleanup actions to erase traces of its activity. One specific batch script is believed to delay execution before deleting evidence, though its exact contents remain unknown to researchers.

In a final, unexplained step, the malware opens a web browser to a specific website hosting Iranian government tender data. The purpose of this user-facing action is unclear. It may serve as a distraction or be part of a broader campaign targeting specific sectors. However, the primary objective remains the continuous theft of credentials and business data through the redundant backdoor infrastructure.