New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Cybersecurity researchers have uncovered a new modular malware called TELEPUZ that has been spreading since late April 2026 through websites infected with ClickFix lures. The malware is full-featured, lightweight, and modular, according to Elastic Security Labs researcher Cyril François. While the number of C2 domains is currently small, the daily volume of builds uploaded to VirusTotal and the rapid pace of updates indicate active development and likely further growth.

TELEPUZ is the second new threat actor after SCMBANKER to be propagated via ClickFix, a social engineering attack that tricks users into manually running malicious commands by disguising them as fixes for fake browser errors, software updates, or CAPTCHA verifications. The technique uses clipboard hijacking (pastejacking) to inject malicious scripts into a victim’s clipboard.

The attack chain begins with PowerShell execution, which downloads a second-stage payload from a remote URL. This payload is a Go variant of Vidar Stealer, which harvests sensitive data and deploys secondary malware—a stager binary that launches TELEPUZ (telepuz.dll) using rundll32.exe. Both the stager and main DLL are retrieved from hurgadatour[.]shop.

Written in C, TELEPUZ is lightweight and modular, likely developed by a solo developer or small team. Daily VirusTotal submissions suggest it is offered under a malware-as-a-service (MaaS) model. It employs obfuscation techniques such as garbage instructions, import name hashing, string encryption, and indirect system calls to thwart analysis. It performs anti-VM and geolocation checks, terminating execution if a sandboxed environment or unauthorized geographic location is detected.

TELEPUZ disables security monitoring by unhooking NTDLL, turning off AMSI and ETW, and removing third-party DllNotification callbacks. It then detects debuggers and validates the parent process name against known runners like rundll32.exe and svchost.exe. It generates a unique victim identifier using hardware serial number, computer name, and OS installation date.

The malware spawns two concurrent threads: one for privilege escalation and service installation, and another for C2 communication. It elevates itself using the COM elevation moniker technique and attempts to gain SYSTEM privilege by stealing tokens from processes like spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe. It registers itself as a service by creating registry keys to load within a new svchost.exe instance.

TELEPUZ attempts to contact its C2 server up to 10 times. If unsuccessful, it fetches fallback C2 addresses using four methods: extracting an encrypted URL from a Telegram profile (t[.]me/chanadarkpart), extracting from a Steam Community profile, running a DNS query for codebasecode[.]com, or extracting from a Polygon blockchain smart contract. Communication uses WebSockets with optional TLS, allowing commands for file enumeration, keystroke logging, command execution, process management, screenshot capture, web injection, and cookie extraction for Chromium-based browsers. It can also download and run executables and DLL modules. The web injector component uses Chrome DevTools Protocol (CDP) and WebDriver BiDi protocol to siphon cookies and run arbitrary JavaScript.

Elastic notes that the limited number of C2 domains suggests the MaaS is still in early stages. Staging domains are protected by Cloudflare, while C2 servers are compromised websites in Brazil and India.