Full research report

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

TELEPUZ demonstrates technically mature operational security from its first observed samples: systematic disabling of Windows security instrumentation, four-channel C2 resilience including a blockchain-based kill switch, CIS-locale exclusions that mark a deliberate attempt to avoid domestic exposure, and a modular 36-command framework covering the full spectrum from data theft to process injection. Its developer chose to enter the market by riding an already-established delivery ecosystem — ClickFix lures feeding into a Go-compiled Vidar Stealer — rather than building bespoke distribution, which compressed time-to-operation significantly. The web-injection module's use of Chrome DevTools Protocol and WebDriver BiDi to intercept live browser financial sessions represents the most direct financial threat to targeted users. No attribution has been established, no named victims are public, and the modular design means detection signatures will require continuous revision as the operator ships new builds; the Elastic YARA rule and IOC set are the highest-confidence defensive starting point currently available.

What happened

From late April 2026, an unnamed actor began distributing TELEPUZ — a modular, C-written Windows backdoor — through ClickFix-infected websites using a three-stage chain: ClickFix lure delivers PowerShell, which drops a Go-compiled Vidar Stealer variant, which in turn retrieves and executes the TELEPUZ DLL via rundll32.exe. First samples appeared on VirusTotal from 2 May 2026, with a significant volume spike in early June. Elastic Security Labs published a comprehensive technical report on 16 July 2026, assessing TELEPUZ as a likely malware-as-a-service offering based on its consistent daily build cadence.

Affected scope

Windows systems globally; CIS-locale systems are deliberately excluded by the malware. No specific sectors or named victim organisations have been identified in public reporting. Capabilities target browser credential stores, session cookies, cryptocurrency wallets, and financial web sessions, suggesting broad opportunistic targeting rather than a vertically focused campaign.

Technical assessment

TELEPUZ installs as a Windows service named 'CipherAllocator' after elevating from user context to Administrator via COM elevation monikers, then to SYSTEM via token theft from legitimate system processes. Before establishing communications, it patches AMSI and ETW to blind endpoint security tooling and removes DLL-load notification callbacks. C2 uses encrypted WebSockets; four independent fallback channels — a Telegram profile, a Steam Community profile, DNS TXT records, and a Polygon blockchain smart contract — provide resilience against takedown, and the smart contract doubles as a kill switch. The malware supports 36 operator commands covering keylogging, browser cookie extraction via Chrome DevTools Protocol and WebDriver BiDi, screenshot capture, file operations, process injection, and arbitrary JavaScript execution in browsers.

Recommended defensive actions

  1. Deploy the Elastic YARA rule 'Windows_Trojan_Telepuz.yar' from the Elastic protections-artifacts GitHub repository across endpoint detection tooling
  2. Block or alert on outbound connections to known IOC domains: hurgadatour[.]shop (staging), cal.joycedoula[.]com[.]br and cal.snehamumbai[.]org (C2), codebasecode[.]com (DNS fallback)
  3. Monitor for new service creation named 'CipherAllocator' and registry writes under HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator
  4. Alert on rundll32.exe loading DLLs from %ProgramData%\XeroxPrint\, %ProgramData%\Jundrax\, or matching AppData\Local\DCFG\Runtime\Themes\Processor\ paths
  5. Block or restrict PowerShell executing web-downloaded payloads — particularly WebClient or Invoke-WebRequest chained with Invoke-Expression or Start-Process
  6. Monitor for COM elevation moniker usage and token-theft attempts targeting spoolsv.exe, msdtc.exe, WmiPrvSE.exe or svchost.exe
  7. Alert on outbound WebSocket connections to unknown hosts using the URI pattern /cdn/health?sid=
  8. Apply application allowlisting to prevent execution of unsigned DLLs via rundll32.exe from user-writable directories

Uncertainties and evidence gaps

  • No named threat actor or group attribution; 'solo developer or small team' is an inference from code patterns and build cadence, not a confirmed identity
  • No government-identified victim organisations or public incident reports specific to TELEPUZ; confirmed victim scale is unknown
  • Whether daily VirusTotal build volume reflects genuine victim deployment or operator testing and development activity has not been determined
  • Scope of web-injection targets — specific financial institutions or platforms configured in operator deployments — has not been disclosed
  • Current operational status of the Telegram channel and Polygon smart contract fallback channels is unconfirmed; no takedown has been reported

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser-initiated — victim must visit a malicious or compromised website and manually execute a pasted clipboard command; no remote unauthenticated exploitation of a product vulnerability
ComponentWindows user session, escalating to Windows service context (SYSTEM) via COM elevation and token theft from system processes
MechanismClickFix social engineering delivers a PowerShell command that downloads a Go-compiled Vidar Stealer variant; Vidar retrieves and executes the TELEPUZ DLL via rundll32.exe after patching AMSI, ETW, and DLL notification callbacks to suppress security monitoring
ImpactFull credential theft, browser session hijacking, keystroke capture, screenshot collection, arbitrary code execution, and persistent service-level access on the infected Windows host
DetectionNew Windows service 'CipherAllocator'; rundll32.exe loading DLLs from ProgramData subdirectories; AMSI and ETW patch attempts; outbound WebSocket connections using /cdn/health?sid= URI; DNS TXT queries to codebasecode[.]com; mutexes cfgmgr_mtx, bginfod_mtx, wfj64_mtx
MitigationNo vendor patch applicable — the malware exploits social engineering and legitimate Windows APIs. Block PowerShell web downloads, deploy TELEPUZ YARA rule, block known IOC domains, restrict rundll32.exe execution of untrusted DLLs from user-writable paths, and monitor for COM elevation and token-theft patterns
Exploitation status

Active distribution confirmed since May 2026 with consistent daily VirusTotal build submissions indicating live MaaS operation; no government-attributed incident reports or confirmed named victim organisations identified in public sources.

Research process

Investigation opened with the THN article as source material, which named Elastic Security Labs as the originating researcher. The Elastic report was located via search, fetched, and confirmed as primary source, providing comprehensive IOCs and technical detail well beyond the THN summary. Searches for the broader ClickFix-to-Vidar delivery context surfaced an ACSC government advisory corroborated via BleepingComputer, independently validating the delivery chain. A final search for underground forum chatter returned no TELEPUZ-specific results, consistent with a newly emerged MaaS with limited public criminal-market visibility.

  1. What does the source article actually report, and is it technically complete?
    Fetched the THN article directly to extract all stated technical claims
    thehackernews.com ↗

    Confirmed: ClickFix delivery, Go Vidar second stage, TELEPUZ DLL via rundll32.exe, hurgadatour[.]shop staging, Telegram/Steam/DNS/blockchain C2 fallback, AMSI/ETW disabling, CIS-locale exclusion, COM elevation and token theft for SYSTEM, WebSocket C2, MaaS assessment. No CVEs cited.

    why Established the event scope and identified the primary technical source (Elastic Security Labs, researcher Cyril François) to verify independently.

  2. Where is the Elastic Security Labs primary report and what independent coverage exists?
    Searched 'TELEPUZ malware ClickFix Elastic Security Labs 2026'

    Elastic report URL confirmed at elastic.co/security-labs/telepuz-maas-malware-clickfix; secondary coverage found at THN, Cyberpress. SCMBANKER mentioned as a separate ClickFix-distributed malware, confirming the broader ClickFix ecosystem.

    why Located the authoritative technical source and established context within the wider ClickFix campaign landscape.

  3. What specific IOCs, commands, and evasion details does the Elastic report contain?
    Fetched the Elastic Security Labs TELEPUZ report
    elastic.co ↗

    36 C2 commands documented; C2 domains in Brazil and India (cal.joycedoula[.]com[.]br, cal.snehamumbai[.]org); staging domain hurgadatour[.]shop; Telegram fallback XOR-encrypted with key 'Goodman'; Polygon smart contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E; four module hash values; YARA rule Windows_Trojan_Telepuz.yar; persistence service 'CipherAllocator'; install paths in ProgramData and AppData; mutexes; anti-sandbox username and computer-name blocklists.

    why Primary source confirmed and substantially expanded all THN claims with defensive-grade IOC and detection detail.

  4. Is the ClickFix-to-Vidar delivery chain independently corroborated by government or security vendors?
    Searched 'ClickFix VidarStealer campaign 2026 PowerShell infostealer'

    ACSC issued an advisory on ClickFix distributing Vidar Stealer via compromised WordPress sites, with BleepingComputer and Malwarebytes providing independent coverage; Microsoft Security Blog also covered macOS ClickFix campaigns. Delivery chain is broadly corroborated across multiple independent sources.

    why Government-level corroboration of the delivery chain used by TELEPUZ raises overall confidence in the reported infection sequence.

  5. What does the ACSC advisory and BleepingComputer reporting add to the defensive picture?
    Fetched BleepingComputer article on the ACSC ClickFix/Vidar advisory
    bleepingcomputer.com ↗

    ACSC advisory dated May 7, 2026; recommends restricting PowerShell execution, application allowlisting, WordPress plugin patching. Confirms Vidar Stealer uses Telegram and Steam for dead-drop C2 resolution — directly matching TELEPUZ's fallback mechanism. Targets Australian organisations.

    why Independently validates the Telegram and Steam dead-drop pattern and provides supplementary government-endorsed defensive actions.

  6. Is there any named threat actor, underground forum advertisement, or dark-web chatter specific to TELEPUZ?
    Searched 'TELEPUZ MaaS malware forum underground dark web actor 2026'

    No forum posts, dark-web listings, or actor attributions specific to TELEPUZ identified. Results returned only the Elastic and THN reports.

    why Absence of underground chatter is consistent with a recently emerged MaaS with limited criminal-market visibility; threat actor identity remains unknown and unattributed.

Named in this story
ActorsUnknown — assessed as solo developer or very small team based on code patterns and build cadence; no named threat actor or group attribution established
MalwareTELEPUZVidar Stealer (Go-compiled variant used as stage-2 dropper)
TargetsWindows systems globally (CIS-locale systems deliberately excluded by malware design)browser credential stores and session cookiescryptocurrency walletsfinancial web sessions via browser injection

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok9 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok256 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Technical references1
github.com/m417z/LdrDllNotificationHook ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

Analysis & research3
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs elastic.co ↗

Primary technical analysis by researcher Cyril François; includes IOCs, 36 documented C2 commands, YARA rule, MITRE ATT&CK mapping and full evasion technique breakdown

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands — The Hacker News thehackernews.com ↗

Secondary reporting summarising the Elastic findings; confirms delivery chain, C2 fallback methods and MaaS assessment

Australia warns of ClickFix attacks pushing Vidar Stealer malware — BleepingComputer bleepingcomputer.com ↗

Reports an ACSC advisory (May 2026) on ClickFix-to-Vidar campaigns; independently corroborates the delivery chain used by TELEPUZ and confirms Telegram/Steam dead-drop C2 pattern