New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
Researchers at Elastic Security Labs have identified a new modular malware called TELEPUZ, distributed since late April 2026 via ClickFix social engineering lures. Written in C, it uses multi-layered defense evasion and redundant C2 fallback channels, including Telegram, …
Intelligence analysis by Llama
TELEPUZ is a lightweight, modular C-based malware delivered through ClickFix pastejacking campaigns, dropping a Vidar Stealer variant first before launching its main DLL. It uses redundant C2 infrastructure and aggressive anti-analysis to enable data theft and remote command execution on compromised Windows hosts.
Bad guys built a sneaky computer bug called TELEPUZ. They trick people into copying and pasting a fake "fix" that secretly installs the bug. Once inside, it steals passwords, takes screenshots, and listens for orders from the attackers. If the attackers' main phone line is cut, the bug finds new numbers hidden in Telegram, Steam, and even on a blockchain.
Analysis
From Pastejacking to Persistent C2
The TELEPUZ campaign highlights how the ClickFix social-engineering playbook keeps paying off for attackers. Victims land on compromised sites that inject a malicious PowerShell command into their clipboard, then prompt them to paste and run it as a "fix" for a fake browser error or CAPTCHA. The result is a two-stage infection: PowerShell pulls a Go-compiled Vidar Stealer variant from hurgadatour[.]shop, which in turn stages the main TELEPUZ DLL via rundll32.exe. The fact that this is the second notable threat family — after SCMBANKER — to ride the ClickFix rail suggests the technique has graduated from opportunistic to operationalized.
A Modular, Evasive Payload
Elastic Security Labs' Cyril François describes TELEPUZ as "full-featured, lightweight, and modular," with daily VirusTotal submissions and rapid build updates that point to a malware-as-a-service operation. The C-compiled binary packs substantial anti-analysis into a small footprint: it unhooks NTDLL, disables AMSI and Event Tracing for Windows, strips DllNotification callbacks, runs anti-VM and anti-debugger checks, and refuses to execute on systems whose locale is a CIS country — a tell that the developers or intended customer base sits in that region. Once installed, it elevates via the COM elevation moniker and token theft from common Windows service processes, then registers itself as a service to survive reboots.
Resilient Infrastructure via the Public Internet
The most operationally interesting wrinkle is TELEPUZ's fallback C2 strategy. When the primary server is unreachable, the malware tries four alternative ways to recover a current address: an encrypted URL in a Telegram channel description, an identical URL embedded in a Steam Community profile, a DNS TXT-style query against codebasecode[.]com, and an encrypted address stored in a Polygon smart contract. That last channel is particularly notable — it effectively turns a public blockchain into an immutable, censorship-resistant dead-drop resolver. Combined with WebSocket-based C2 (with optional TLS) and capabilities spanning file enumeration, keystroke logging, screenshot capture, web injection, and CDP/WebDriver BiDi abuse in Chromium and Firefox, the toolkit gives operators a durable foothold with broad post-exploitation reach.
Key points
- TELEPUZ is a modular C-based malware spread via ClickFix pastejacking since late April 2026, making it the second major family after SCMBANKER to abuse that technique.
- Infection starts with PowerShell dropping a Go-compiled Vidar Stealer variant, which then stages the main TELEPUZ DLL via rundll32.exe from hurgadatour[.]shop.
- The payload aggressively evades defenses by unhooking NTDLL, disabling AMSI and ETW, removing DllNotification callbacks, and running anti-VM, anti-debug, and CIS-locale checks.
- C2 communication uses WebSockets with optional TLS, and if the primary server fails, TELEPUZ recovers a fallback address from Telegram, Steam, DNS, or a Polygon smart contract.
- Steady VirusTotal submission volume and rapid build updates suggest a malware-as-a-service model with broad post-exploitation features including keystroke logging, screenshots, web injection, and cookie theft.
- Elastic Security Labs attributes the analysis to researcher Cyril François.
Because Elastic Security Labs has publicly documented TELEPUZ's indicators — including the hurgadatour[.]shop staging domain, the Telegram and Steam C2 channels, and the codebasecode[.]com DNS fallback — defenders can hunt for these artifacts and block them across endpoints and network gateways. The malware's CI **Note:** The article body is truncated mid-sentence ("despite the hig"), so the optimistic and pessimistic outlooks are constrained to what the visible text supports. king of CIS locales and its reliance on a small number of currently known C2 domains also create a window where detection rules and geofencing can blunt its spread. Oops — I need to keep the field clean. Let me continue properly.
Omit this field per the article's limited downside framing — the article is descriptive, not speculative.
