Researchers at Securonix have disclosed a new Windows backdoor, tracked as TASK#STOMP, that quietly harvests business documents and other sensitive data from infected PCs. The infection starts with a script file — likely delivered as a phishing email attachment inside a ZIP or ISO/IMG file — that a user double-clicks from their desktop. Once run, it plants itself in five separate places at once: four scheduled tasks disguised with innocuous Windows-sounding names (such as "Network Audio Service") and a copy in the Startup folder, so removing just one leftover doesn't clean the infection.
From there, two hidden PowerShell components take over. One continuously scans the machine's drives for Word, PDF, PowerPoint, and Excel files — plus archives — uploading them to an attacker-controlled server and watching for any new or edited document to steal next. The other steals saved Wi-Fi passwords and clipboard contents, takes screenshots, and can run further commands sent by the operators. The document-first priority order suggests this is targeted corporate espionage rather than opportunistic crimeware. Researchers built their analysis from one infected machine and have not confirmed how widely the campaign has spread, but the technique itself — scripted delivery plus redundant persistence — is one commodity attackers copy quickly once it's public.
What this means for your business
If your team handles contracts, tenders, or other sensitive documents on Windows PCs, this is worth a look this week. Ask your IT provider or in-house admin two things: first, whether your email gateway blocks or flags ISO, IMG, and VBS/script attachments, since these routinely slip past filters tuned only for .exe files; second, whether Windows Script Host (wscript.exe) is restricted so it can't silently run a script a user just downloaded to their Desktop or Downloads folder — most business PCs never need this to run freely. If you want to check for existing infection, look in Task Scheduler for scheduled tasks you don't recognise using generic system-sounding names, and check the Startup folder for anything unfamiliar. Because this malware rebuilds itself if only part of it is removed, a suspected infection should be handled as a full cleanup — scheduled tasks, Startup entries, and staged files removed together, on a machine you then reboot and re-check, not fixed one item at a time.