Malware

TELEPUZ

TELEPUZ is a modular Windows remote-access malware family active since at least late April 2026 and commonly delivered through ClickFix social-engineering chains. Victims are lured into manually executing a malicious command from a fake verification or troubleshooting page, after which a VIDAR stage retrieves a TELEPUZ stager and the main payload. TELEPUZ appears to be under active development and has been assessed as a likely malware-as-a-service offering, although no specific operator has been confirmed.

The malware is designed to remain lightweight at first and extend functionality through additional modules. Core capabilities include remote command execution, file and process operations, screenshot capture, host reconnaissance, and data upload. Downloaded modules add keylogging, browser cookie extraction, credential and data theft, and web-injection functionality. Its web-injection component interacts with Chromium-based browsers and Firefox through browser debugging interfaces rather than traditional browser hooking, and observed rule sets indicate an emphasis on financial fraud by altering payment-related form fields.

TELEPUZ incorporates extensive anti-analysis and defense-evasion measures. Reported behaviors include anti-virtual-machine and anti-debugging checks, geofencing to avoid systems configured for certain CIS-region locales, string encryption, dynamic API resolution, indirect system calls, unhooking of NTDLL, patching of AMSI and ETW-related functions, and removal of third-party DLL notification callbacks. It can relaunch itself through trusted Windows utilities, validate execution context, and terminate or stall when sandboxing or debugging is detected.

For persistence and privilege gain, TELEPUZ can copy itself into persistent locations, bypass User Account Control, steal higher-privileged tokens, and register itself as a Windows service. Command-and-control communications use a WebSocket-based JSON protocol. If primary infrastructure is unavailable, TELEPUZ can recover encrypted fallback command-and-control information through multiple dead-drop style channels, including Telegram, Steam profile metadata, DNS, and a Polygon blockchain smart contract; the blockchain mechanism has also been used as a kill-switch condition.

TELEPUZ targets Windows systems and should be treated as a full-compromise malware family because it combines durable access, credential and session theft, browser manipulation, and secondary payload delivery within a single modular framework.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

31 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence3

From there, operators can pick from 36 commands. Those cover screenshots, file upload, process listing, and shellcode injection.

T1129Shared ModulesEvidence1

The malware pulls its features down as separate modules... Meanwhile, separate downloaded modules handle keylogging, stealing, browser cookie theft, and web injection.

T1204User ExecutionEvidence2

A victim lands on a malicious page and sees a prompt to copy and paste a Windows shell command. Running that command fetches the second stage into the temporary folder.

T1574Hijack Execution FlowEvidence1

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe...

Persistence

2 techniques

T1543.003Windows ServiceEvidence3

Then it elevates privileges through a UAC bypass and registers itself as a Windows service under a harmless-looking name.

T1547Boot or Logon Autostart ExecutionEvidence1

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe... and register a Windows service.

Privilege Escalation

6 techniques

T1055Process InjectionEvidence2

...and run executable files inside hollowed processes...

T1134Access Token ManipulationEvidence2

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe, bypass User Account Control, steal higher-privileged access tokens...

T1543.003Windows ServiceEvidence3

Then it elevates privileges through a UAC bypass and registers itself as a Windows service under a harmless-looking name.

T1547Boot or Logon Autostart ExecutionEvidence1

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe... and register a Windows service.

T1548Abuse Elevation Control MechanismEvidence1

...bypass User Account Control, steal higher-privileged access tokens...

T1548.002Bypass User Account ControlEvidence2

Then it elevates privileges through a UAC bypass and registers itself as a Windows service under a harmless-looking name.

Stealth

11 techniques

T1027Obfuscated Files or InformationEvidence2

It also uses encrypted strings, dynamic API lookups, indirect system calls...

T1027.005Indicator Removal from ToolsEvidence1

Should the checks pass, the malware unhooks NTDLL, patches AMSI and ETW, and strips third-party DLL notification callbacks.

T1027.007Dynamic API ResolutionEvidence1

It also uses encrypted strings, dynamic API lookups, indirect system calls...

T1027.013Encrypted/Encoded FileEvidence1

Each holds an encrypted address that operators can rotate at will.

T1055Process InjectionEvidence2

...and run executable files inside hollowed processes...

T1070Indicator RemovalEvidence1

They include options to run commands, list files and processes, take screenshots, upload data, create ZIP archives, delete files...

T1134Access Token ManipulationEvidence2

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe, bypass User Account Control, steal higher-privileged access tokens...

T1218.011Rundll32Evidence1

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe...

T1497Virtualization/Sandbox EvasionEvidence2

Before beginning normal activity, TELEPUZ checks whether it is running in a virtual machine, sandbox, debugger, or an excluded geographic region.

T1497.001System ChecksEvidence1

The main library then checks where it runs from and moves itself to a persistence folder. Next, it runs anti-VM and anti-debugger checks. It also skips machines whose language settings match a hardcoded list of CIS countries. If it spots a sandbox, it simply quits.

T1574Hijack Execution FlowEvidence1

For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe...

Credential Access

2 techniques

T1056.001KeyloggingEvidence3

Meanwhile, separate downloaded modules handle keylogging, stealing, browser cookie theft, and web injection.

T1539Steal Web Session CookieEvidence3

Its default rules focus on swapping payment fields such as the IBAN, which points at financial fraud. | Meanwhile, separate downloaded modules handle keylogging, stealing, browser cookie theft, and web injection.

Discovery

4 techniques

T1057Process DiscoveryEvidence1

From there, operators can pick from 36 commands. Those cover screenshots, file upload, process listing, and shellcode injection.

T1082System Information DiscoveryEvidence1

It beacons hostname, username, OS version, and architecture.

T1497Virtualization/Sandbox EvasionEvidence2

Before beginning normal activity, TELEPUZ checks whether it is running in a virtual machine, sandbox, debugger, or an excluded geographic region.

T1497.001System ChecksEvidence1

Collection

3 techniques

T1056.001KeyloggingEvidence3

Meanwhile, separate downloaded modules handle keylogging, stealing, browser cookie theft, and web injection.

T1113Screen CaptureEvidence3

From there, operators can pick from 36 commands. Those cover screenshots, file upload, process listing, and shellcode injection.

T1185Browser Session HijackingEvidence1

The malware also includes a web-injection module that can interact with Chromium-based browsers and Firefox.

Command and Control

6 techniques

T1008Fallback ChannelsEvidence1

It can repeatedly try its main server, then seek replacement infrastructure through Telegram, a Steam profile, DNS records, or a Polygon blockchain smart contract if contact fails.

T1071Application Layer ProtocolEvidence2

Once connected, TELEPUZ speaks a simple JSON protocol over WebSockets. It beacons hostname, username, OS version, and architecture.

T1071.001Web ProtocolsEvidence2

Once connected, TELEPUZ speaks a simple JSON protocol over WebSockets.

T1105Ingress Tool TransferEvidence1

Running that command fetches the second stage into the temporary folder. In this campaign, VIDAR pulls down two more pieces: a small stager and the main TELEPUZ library.

T1219Remote Access ToolsEvidence1

The campaign delivers TELEPUZ, a lightweight but capable remote-access malware that can receive dozens of instructions from its operators.

T1568Dynamic ResolutionEvidence1

On failure, it reaches for four fallback methods. Those include a Telegram profile, a Steam profile name, a DNS record, and a smart contract on the Polygon blockchain. Each holds an encrypted address that operators can rotate at will.

Other

1 technique

T1562Impair DefensesEvidence2

...and patches designed to weaken Windows antimalware scanning and event tracing.

INDICATORS OF COMPROMISE

IOCs tracked for this family

63 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

28 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

25 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 days ago

domain●●●●●●●●●●●●View more in app28 days ago

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

security online infoNews

Jul 21, 2026

TELEPUZ Malware Spreads via ClickFix Attack Chain

A modular Windows malware family delivered via ClickFix social engineering and a VIDAR loader. It uses WebSocket C2, supports 36 commands, performs anti-VM/anti-debugging checks, unhooks NTDLL, patches AMSI and ETW, uses a UAC bypass for privilege escalation, persists as a Windows service, and downloads modules for keylogging, credential/data theft, browser cookie theft, and web injection aimed at payment-field manipulation such as IBAN swapping.

cryptika blogNews

Jul 20, 2026

ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands | Cryptika Cybersecurity

A modular remote-access malware delivered via ClickFix social engineering. It uses WebSockets and a JSON-based protocol for C2, supports 36 remote commands, can download additional modules for credential theft, keylogging, browser cookie extraction, web injection, process hollowing, persistence, UAC bypass, token theft, and anti-analysis/evasion.

cyber security newsNews

Jul 20, 2026

ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands

TELEPUZ is a modular remote-access malware delivered via ClickFix lures. It uses WebSockets and a JSON-based protocol for C2, supports fallback C2 retrieval via Telegram, Steam, DNS, and a Polygon smart contract, and can execute commands, manage files/processes, take screenshots, upload data, deploy additional modules, steal browser cookies, run a keylogger, and perform web injection against Chromium-based browsers and Firefox. It also includes anti-analysis, UAC bypass, token theft, and Windows service persistence features.

the hacker newsNews

Jul 19, 2026

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

Named as another malware family distributed via ClickFix in the broader threat landscape.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching63

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping31

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

TELEPUZ