Loading story…
Researchers disclosed TASK#STOMP, a VBScript-led, PowerShell-based Windows backdoor built for corporate espionage. The malware inventories and exfiltrates business documents, watches for newly created or modified files, steals saved Wi-Fi passwords and clipboard contents, captures screenshots and system metadata, and allows operators to run arbitrary PowerShell commands. Its components communicate with redundant command-and-control domains using a hardcoded authentication token.
TASK#STOMP maintains access through four masquerading scheduled tasks and a Startup-folder script, with two PowerShell components configured to monitor one another; partial remediation may therefore permit reinfection. The malware also uses hidden execution, timestomping, native Windows utilities, process control, and cleanup mechanisms to frustrate detection and forensic analysis. Researchers observed an Iranian government-tender website opened in Chrome by the orchestrator, though its purpose is unknown; the campaign's delivery method, scope, duration, and responsible actor remain unconfirmed.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers disclosed TASK#STOMP, a VBScript-led and PowerShell-based Windows backdoor that collects business documents, Wi-Fi passwords, clipboard data, screenshots, and system metadata, while supporting remote command execution. Analysis identified redundant scheduled-task and Startup-folder persistence, mutually monitoring PowerShell components, and C2 communications with corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz; delivery vector, campaign scope, duration, and attribution remain unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcehelpnetsecurity.com
Open sourcesecuronix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign using obfuscated **VBS** and **PowerShell** stages hosted across multiple DuckDNS domains to infect 64-bit Windows systems with a remote access trojan. The chain decrypts an **AES-256**-protected PowerShell stage, extracts a 64-bit payload, and uses a .NET helper to hollow `AppLaunch.exe` for stealthy execution. The malware then establishes persistence through the Windows Startup folder and attempts to weaken defenses by adding Microsoft Defender exclusions. The RAT communicates with suspected command-and-control infrastructure over port `4577` and is designed for credential theft and surveillance. Reported capabilities include stealing browser credentials and cookies, keylogging, clipboard capture, remote control, and local storage of stolen data, raising the risk of account takeover and broader compromise of enterprise sessions and sensitive information. The reporting includes hashes, filenames, domains, an IP address, and filesystem paths as indicators of compromise, with defenders urged to block the infrastructure, hunt for suspicious PowerShell activity, and isolate affected hosts.
Aug 10, 2026
Researchers detailed a **MetaStealer** infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from **GitHub** and **transfer.sh**, built a persistent executable on the host, and modified `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to `193.106.191.162:1775` matched **EmergingThreats Pro** detections for Win32/MetaStealer activity. Separate reverse engineering showed MetaStealer used **XOR-based string decryption** and a **domain generation algorithm (DGA)** to supplement or replace static command-and-control infrastructure by generating multiple `.xyz` domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including **SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints**, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Aug 15, 2026
Researchers at eSentire disclosed a previously undocumented remote access trojan, **STX RAT**, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used **XXTEA** encryption, **Zlib** compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and **COM hijacking** to establish persistence and frustrate analysis. Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Jun 29, 2026