A recent malware campaign is exploiting a technique known as ClickFix to deceive Windows users into executing malicious commands, leading to the deployment of TELEPUZ, a modular remote-access trojan (RAT) capable of executing 36 distinct commands.
The attack initiates with a counterfeit verification page that prompts users to copy and run a command. This action downloads a VIDAR-based second-stage payload, which subsequently retrieves the TELEPUZ loader and its main component. This method aligns with previous ClickFix campaigns that manipulate user actions to gain initial system access.
According to a report from Elastic, TELEPUZ has been active since late April 2026, with a notable surge in activity from early June, indicating rapid development and expansion. The malware’s design is lightweight, allowing it to download additional modules as needed, thereby enabling functionalities such as information theft, keystroke logging, and browser manipulation without overburdening the initial payload.
TELEPUZ’s Communication and Command Capabilities
TELEPUZ communicates with its command-and-control (C2) server via WebSockets, utilizing a JSON-based protocol for data exchange and task reception. If the primary C2 server is unreachable, the malware can seek alternative infrastructure through platforms like Telegram, Steam profiles, DNS records, or Polygon blockchain smart contracts.
The malware’s 36 commands provide attackers with extensive control over infected systems. These commands include executing arbitrary commands, listing files and processes, capturing screenshots, uploading data, creating ZIP archives, deleting files, adjusting beacon intervals, updating the malware, and terminating processes.
Notably, several commands are tailored for credential theft and further intrusion. TELEPUZ can deploy a stealer module, initiate a keylogger, extract cookies from Chromium-based browsers, download additional malware modules, and execute files within hollowed processes, positioning it among threats that target browser credentials and cookies.
Additionally, TELEPUZ features a web-injection module capable of interacting with Chromium-based browsers and Firefox. This component can intercept web pages, execute JavaScript, manage rules, and potentially alter financial form fields, enhancing its capability to manipulate browser activities.
Evasion Techniques and Defensive Measures
Before commencing its operations, TELEPUZ performs checks to determine if it is running in a virtual machine, sandbox, debugger, or an excluded geographic region. It employs encrypted strings, dynamic API lookups, indirect system calls, and patches designed to weaken Windows antimalware scanning and event tracing.
For persistence, the malware can replicate itself from temporary folders, relaunch through rundll32.exe, bypass User Account Control (UAC), steal higher-privileged access tokens, and register as a Windows service. These measures complicate detection and removal efforts.
The emergence of TELEPUZ underscores the evolving sophistication of malware campaigns leveraging social engineering techniques like ClickFix. Users are advised to exercise caution when prompted to execute commands or download files from unverified sources. Organizations should implement robust security protocols, including regular software updates, employee training on phishing tactics, and the deployment of advanced threat detection systems to mitigate such threats.
