Do Son 
TELEPUZ infection chain diagram | Image: Elastic Security Labs
At a glance
| Malware family | TELEPUZ |
| Threat actor | Unnamed; suspected solo developer or small team running a MaaS |
| Target / victims | Windows users reached through compromised web pages |
| Delivery vector | ClickFix social engineering, then a VIDAR loader and a small stager |
| Key capabilities | 36 commands, WebSocket C2, keylogger, stealer and web-inject modules, UAC bypass |
| Source | Elastic Security Labs |
TL;DR
Elastic Security Labs is tracking a new modular malware family called TELEPUZ. Attackers deliver it through a ClickFix page that leads to VIDAR, which then drops the real payload. The malware pulls its features down as separate modules and talks to its server over WebSockets.
Delivery starts with a ClickFix attack
The chain opens with social engineering, not an exploit. A victim lands on a malicious page and sees a prompt to copy and paste a Windows shell command. Running that command fetches the second stage into the temporary folder.
That second stage is a Go build of VIDAR, a well-known loader and stealer. Australia’s ACSC flagged the same ClickFix-to-VIDAR pattern in a May 2026 advisory, which shows how widely the technique now travels. In this campaign, VIDAR pulls down two more pieces: a small stager and the main TELEPUZ library.
Infection chain at a concept level
The stager is tiny, roughly 13 to 15 KB. Its only job is to fetch the main DLL and run it through a trusted Windows utility. After that, the payload takes over.
The main library then checks where it runs from and moves itself to a persistence folder. Next, it runs anti-VM and anti-debugger checks. It also skips machines whose language settings match a hardcoded list of CIS countries. If it spots a sandbox, it simply quits.
Should the checks pass, the malware unhooks NTDLL, patches AMSI and ETW, and strips third-party DLL notification callbacks. Then it elevates privileges through a UAC bypass and registers itself as a Windows service under a harmless-looking name.
Command and control, and data theft
TELEPUZ ships with a single C2 domain and tries it up to 10 times. On failure, it reaches for four fallback methods. Those include a Telegram profile, a Steam profile name, a DNS record, and a smart contract on the Polygon blockchain. Each holds an encrypted address that operators can rotate at will.
The blockchain lookup doubles as a kill switch. If the contract returns too little data, the malware shuts its thread down.
Once connected, TELEPUZ speaks a simple JSON protocol over WebSockets. It beacons hostname, username, OS version, and architecture. From there, operators can pick from 36 commands. Those cover screenshots, file upload, process listing, and shellcode injection. Meanwhile, separate downloaded modules handle keylogging, stealing, browser cookie theft, and web injection.
The web-inject module stands out. Rather than hooking the browser, it drives Chromium and Firefox through their own debugging protocols. Its default rules focus on swapping payment fields such as the IBAN, which points at financial fraud.
Attribution is suspected, not confirmed
No named actor sits behind TELEPUZ yet. Elastic describes the code as full-featured, lightweight, and modular
and reads the sparse structure as the work of a solo developer or a very small team. Given the daily build volume, researchers wrote that it is likely that we are dealing with a MaaS
. Treat that as an assessment, not a confirmed fact.
Sourced figures
- First sample submitted to VirusTotal on May 2, 2026.
- Telegram and blockchain artifacts date activity to roughly April 27–29, 2026.
- A single VirusTotal pivot returns about 429 related files.
- Only two core C2 domains, both compromised legitimate sites in Brazil and India.
Defense and detection guidance
Most of this chain depends on one human action. Cut that, and you cut the infection.
- Teach staff never to paste commands from a web page into a terminal or Run box.
- Restrict or monitor script hosts launching from the temporary folder.
- Alert on trusted Windows utilities loading DLLs out of user-writable directories.
- Watch for outbound WebSocket traffic from unusual host processes.
- Treat blockchain RPC calls from ordinary endpoints as a strong signal.
- Flag new services whose configuration points at a DLL in a temporary path.
Why this matters now
TELEPUZ is still unfinished. One injection command even returns a placeholder marker, confirming that the malware is still in active development
. Yet builds arrive daily, and the module design lets the author bolt on features fast. A small C2 footprint today does not promise a small one tomorrow.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
