TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering — Threadlinqs Intelligence
As of 2026-07-16, TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1386 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Elastic Security Labs identified TELEPUZ, a new modular malware-as-a-service (MaaS) platform distributed via ClickFix social engineering that tricks victims into executing an obfuscated PowerShell
TELEPUZ is a newly identified, actively-developed modular malware-as-a-service platform documented by Elastic Security Labs, distributed since late April 2026 through ClickFix-style social engineering. Victims are lured to a malicious webpage that instructs them to paste and run an obfuscated PowerShell command (using `-NoP -w h -ep bypass` flags to disable the profile, hide the window, and bypass execution policy). This command downloads a VIDAR Go variant (SHA256 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954) from `hxxps://memshowblob[.]forum/api/index.php?a=grab`, which in turn retrieves the TELEPUZ third-stage stager (`install.exe`, a small ~13-15KB PE) and the main payload (`telepuz.dll`) from `hurgadatour[.]shop`.
The stager launches the main DLL via `rundll32.exe` using obfuscated export names. The DLL is a 64-bit Windows library built from lightweight, modular C code that masquerades as legitimate software; the codebase and build cadence (steady VirusTotal submissions since May 2, 2026 with a spike in June) suggest a small team or solo developer iterating rapidly on a commercial MaaS offering.
TELEPUZ's `DllMain` re-executes the malware via `rundll32.exe` unless already running as `svchost.exe` or `rundll32.exe`, then hands off to a `ServiceRoutine` entry point that installs persistence, initializes an indirect-syscall engine, performs anti-VM/anti-debug checks, escalates privileges, installs itself as a Windows service, and opens C2 communication.
Evasion is extensive: garbage-instruction obfuscation and custom import hashing complicate static analysis; strings are RC4-encrypted with per-sample keys; API calls are issued via indirect syscalls generated by mapping a fresh copy of `ntdll.dll`, parsing syscall numbers, and patching trampoline stubs into the `.text` sections of unrelated system DLLs (`dfscli.dll`, `davhlpr.dll`, `msdtclog.dll`, `dsrole.dll`, `secur32.dll`). The malware unhooks NTDLL by remapping a clean copy via `NtMapViewOfSection` and restoring patched bytes, patches `AmsiScanBuffer` to force an `E_INVALIDARG` return, and patches `EtwEventWrite`/`NtTraceEvent`/`NtTraceEventControl` to zero out ETW telemetry. It also strips non-Windows DLL-load-notification callbacks and performs extensive anti-debug checks (`NtQueryInformationProcess` debug-port/flags/object-handle checks, hardware breakpoint inspection via `NtGetContextThread`, `ThreadHideFromDebugger`, a deliberate `NtClose(0xDEADBEEF)` crash, and `PEB.BeingDebugged` inspection), sleeping indefinitely if a debugger is detected.
Privilege escalation bypasses UAC via a COM elevation moniker (creating an elevated COM object and invoking `ShellExecute`) or, alternatively, by launching `winver.exe` in debug mode through `RAicLaunchAdminProcess`, capturing its debug-object handle, launching auto-elevated `computerdefault.exe`, and attaching the captured handle via `DbgUiSetThreadDebugObject`. For SYSTEM-level access it steals tokens from `spoolsv.exe`, `msdtc.exe`, `WmiPrvSE.exe`, and `svchost.exe`.
Persistence migrates the payload from `%TEMP%` to `%AppData%`/`%ProgramData%` locations (observed paths include `%AppData%\Local\DCFG\Runtime\Themes\Processor\etwhost.dll`, `%AppData%\Roaming\StateRepository\Host\Recovery\systemreset.dll`, and `%ProgramData%\XeroxPrint\Temp\Worker\grpeng.dll`), creates the mutex `cfgmgr_mtx` (plus `bginfod_mtx` and `wfj64_mtx` in other components), and registers a Windows service (`CipherAllocator`, also seen as `PilotmasterMast`).
A per-host session ID is derived by combining the hardware serial, computer name, and OS install date through FNV1-32 and ROR27 hashing into a 16-character hex identifier. Anti-VM logic checks for low CPU/RAM/disk, blocks execution in CIS-region locales (Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova), compares hostnames/usernames against sandbox-indicative wordlists, and inspects display-device names for k
Target sectors: finance, general consumer enterprise endpoints
Target regions: Global, excludes CIS countries (Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1584, T1587, T1566, T1059, T1106, T1218, T1204, T1543, T1547