Wisevoter
World

Researchers Discovered TASK#STOMP Windows Backdoor

A new malware strain uses scheduled tasks to steal corporate documents and Wi-Fi credentials.

Updated on Sept. 21, 2026 in Cybersecurity

Isometric editorial illustration of a heavy steel vault door slightly ajar, symbolizing cybersecurity threats and digital infrastructure vulnerabilities.
Security researchers identified the TASK#STOMP Windows backdoor, a sophisticated malware strain engineered to exfiltrate corporate documents through hidden system tasks. AI Illustration. Upload story photo >

Live Poll

Do you trust your organization's current security measures to stop new, unknown malware threats?

Security researchers have identified a sophisticated Windows backdoor dubbed TASK#STOMP designed to exfiltrate sensitive business files. The malware specifically targets documents like PDFs and Office files while maintaining persistence through hidden system tasks.

Why it matters

By prioritizing the theft of corporate contracts and trade-related documents, the malware appears engineered for high-level industrial espionage. Its reliance on hardcoded authentication suggests a targeted campaign rather than a broad, automated attack.

The malware establishes 5 total footholds on a machine, including 4 scheduled tasks and an additional copy placed in the Windows Startup folder.

The players

Securonix

A cybersecurity firm that provides threat intelligence and behavior analytics to detect advanced persistent threats.

The details

Infection begins via a VBScript file on the desktop, which triggers hidden PowerShell modules that monitor each other for uninterrupted operation. The malware disguises itself in a folder named WinDefendSvc and utilizes anti-forensic techniques by backdating its files.

Timeline

  1. January 15, 2024: Fabricated date used by malware for anti-forensics.

  2. September 21, 2026: Publication of the Securonix research report.

The Big Picture

This discovery tracks with the established use of IranTenders-themed lures in espionage campaigns. The emergence of TASK#STOMP follows a pattern of document-stealing malware often seen in campaigns targeting international trade and tender contracts.

Users should be cautious of unsolicited VBScript files located on their desktops, as these are the primary entry point for the infection. Administrators should monitor for suspicious folders named WinDefendSvc to detect unauthorized persistence on enterprise machines.

The takeaway

Security teams should prioritize updating detection rules for PowerShell activity and auditing active scheduled tasks. Employees handling trade or contract documents should verify file sources before execution to prevent unauthorized credential and data exfiltration.

Further reading

Learn more about emerging digital threats on our Cybersecurity section.

Live Poll

Do you trust your organization's current security measures to stop new, unknown malware threats?