TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering

TELEPUZ: New Modular Malware-as-a-Service Distributed via (TL-2026-1386), also tracked as TELEPUZ MaaS, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Microsoft Windows (desktop/workstation), maps to 37 MITRE ATT&CK techniques (T1008, T1021, T1027), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1386

Threat ID
TL-2026-1386
Also known as
TELEPUZ MaaS
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
finance, general consumer enterprise endpoints
Target regions
Global, excludes CIS countries (Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova)
Detection rules
9
Indicators of compromise
30

Malware and tooling in TELEPUZ: New Modular Malware-as-a-Service Distributed via

Malware and tooling: TELEPUZ, VIDAR Go, Polygon blockchain dead-drop resolver (contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E)

Elastic Security Labs identified TELEPUZ, a new modular malware-as-a-service (MaaS) platform distributed via ClickFix social engineering that tricks victims into executing an obfuscated PowerShell command. The command chain fetches a VIDAR Go loader which retrieves the TELEPUZ stager and main DLL payload, employing process hollowing, COM-elevation UAC bypass, NTDLL unhooking, AMSI/ETW patching, and indirect syscalls to evade detection.

How TELEPUZ: New Modular Malware-as-a-Service Distributed via works

TELEPUZ is a newly identified, actively-developed modular malware-as-a-service platform documented by Elastic Security Labs, distributed since late April 2026 through ClickFix-style social engineering. Victims are lured to a malicious webpage that instructs them to paste and run an obfuscated PowerShell command (using `-NoP -w h -ep bypass` flags to disable the profile, hide the window, and bypass execution policy). This command downloads a VIDAR Go variant (SHA256 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954) from `hxxps://memshowblob[.]forum/api/index.php?a=grab`, which in turn retrieves the TELEPUZ third-stage stager (`install.exe`, a small ~13-15KB PE) and the main payload (`telepuz.dll`) from `hurgadatour[.]shop`.

The stager launches the main DLL via `rundll32.exe` using obfuscated export names. The DLL is a 64-bit Windows library built from lightweight, modular C code that masquerades as legitimate software; the codebase and build cadence (steady VirusTotal submissions since May 2, 2026 with a spike in June) suggest a small team or solo developer iterating rapidly on a commercial MaaS offering.

TELEPUZ's `DllMain` re-executes the malware via `rundll32.exe` unless already running as `svchost.exe` or `rundll32.exe`, then hands off to a `ServiceRoutine` entry point that installs persistence, initializes an indirect-syscall engine, performs anti-VM/anti-debug checks, escalates privileges, installs itself as a Windows service, and opens C2 communication.

Evasion is extensive: garbage-instruction obfuscation and custom import hashing complicate static analysis; strings are RC4-encrypted with per-sample keys; API calls are issued via indirect syscalls generated by mapping a fresh copy of `ntdll.dll`, parsing syscall numbers, and patching trampoline stubs into the `.text` sections of unrelated system DLLs (`dfscli.dll`, `davhlpr.dll`, `msdtclog.dll`, `dsrole.dll`, `secur32.dll`). The malware unhooks NTDLL by remapping a clean copy via `NtMapViewOfSection` and restoring patched bytes, patches `AmsiScanBuffer` to force an `E_INVALIDARG` return, and patches `EtwEventWrite`/`NtTraceEvent`/`NtTraceEventControl` to zero out ETW telemetry. It also strips non-Windows DLL-load-notification callbacks and performs extensive anti-debug checks (`NtQueryInformationProcess` debug-port/flags/object-handle checks, hardware breakpoint inspection via `NtGetContextThread`, `ThreadHideFromDebugger`, a deliberate `NtClose(0xDEADBEEF)` crash, and `PEB.BeingDebugged` inspection), sleeping indefinitely if a debugger is detected.

Privilege escalation bypasses UAC via a COM elevation moniker (creating an elevated COM object and invoking `ShellExecute`) or, alternatively, by launching `winver.exe` in debug mode through `RAicLaunchAdminProcess`, capturing its debug-object handle, launching auto-elevated `computerdefault.exe`, and attaching the captured handle via `DbgUiSetThreadDebugObject`. For SYSTEM-level access it steals tokens from `spoolsv.exe`, `msdtc.exe`, `WmiPrvSE.exe`, and `svchost.exe`.

Persistence migrates the payload from `%TEMP%` to `%AppData%`/`%ProgramData%` locations (observed paths include `%AppData%\Local\DCFG\Runtime\Themes\Processor\etwhost.dll`, `%AppData%\Roaming\StateRepository\Host\Recovery\systemreset.dll`, and `%ProgramData%\XeroxPrint\Temp\Worker\grpeng.dll`), creates the mutex `cfgmgr_mtx` (plus `bginfod_mtx` and `wfj64_mtx` in other components), and registers a Windows service (`CipherAllocator`, also seen as `PilotmasterMast`).

A per-host session ID is derived by combining the hardware serial, computer name, and OS install date through FNV1-32 and ROR27 hashing into a 16-character hex identifier. Anti-VM logic checks for low CPU/RAM/disk, blocks execution in CIS-region locales (Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova), compares hostnames/usernames against sandbox-indicative wordlists, and inspects display-device names for known hypervisor signatures.

C2 communication uses a WebSocket channel at `/cdn/health?sid=` (optionally TLS via SChannel) to domains `cal.joycedoula[.]com[.]br` (earliest configs) and `cal.snehamumbai[.]org` (latest), both believed to be compromised legitimate websites hosted in Brazil and India respectively. TELEPUZ ships a resilient, multi-layer fallback resolution chain if the primary C2 is unreachable: a Telegram profile (`t.me/chanadarkpart`) containing an XOR-encrypted (key "Goodman") fallback URL; a Steam profile (`steamcommunity.com/profiles/76561199705801219`) with an encrypted C2 address embedded in the username; a DNS TXT-style lookup against `codebasecode[.]com` (not yet observed in the wild); and a Polygon blockchain dead-drop resolver that issues JSON-RPC calls to smart contract `0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E`, AES-256-CBC decrypting the returned value with a hardcoded key and triggering a kill-switch if the decrypted result is under 10 bytes.

The C2 protocol supports 36 identified commands (hashed with a custom `0x1505` seed / `0x21*hash` XOR scheme) spanning reconnaissance (ListRunningProcesses, ListJobs, Screenshot), execution (ExecuteCommand, DownloadRunPE, DownloadRunModule, DownloadLoadMalwareModule, MigrateIntoProcess), credential/browser theft (ExtractChromeCookiesUsingDownloadedChromeElevator, StealProcessToken), keylogging (GetKeyLoggerStatus, KeyLoggerEnableDisableFormFlush), privilege escalation (ElevateToAdmin, ElevateToSystem), self-update/cleanup (UpdateMalware, Delete, Kill), and staged exfiltration (CreateZip, Upload). An `InjectShellcode` command exists but is unimplemented, returning "INJECT:TODO" — evidence of the platform's active, in-progress development.

TELEPUZ is genuinely modular: additional PE/DLL modules are fetched on demand, including a keylogger (`/static/modules/kMP6HBGEA8.bin`), a web-injector (`/static/modules/yaVaoS3Bw.bin`), a stealer (`/static/modules/W2UMxylgG_.bin`), and a Chrome cookie extractor leveraging the public Chrome-App-Bound-Encryption-Decryption technique (`/static/assets/chromeelevator.bin`). The web-injector communicates over STDIN/STDOUT/STDERR and drives the Chrome DevTools Protocol (for Chromium browsers) or WebDriver BiDi (for Firefox) to swap banking form fields — specifically IBAN values — based on a JSON configuration of action definitions, intercept filters, and trigger conditions, indicating a financial-fraud monetization path alongside generic credential/cookie theft.

Elastic observed a steady staging-domain rotation cadence (roughly weekly new domains) since May 2026, and published a YARA detection rule (`Windows_Trojan_Telepuz.yar`) in its public protections-artifacts GitHub repository.

MITRE ATT&CK techniques used in TL-2026-1386

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1134 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055 Process Injection; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Collection

T1056 Input Capture; T1113 Screen Capture; T1119 Automated Collection; T1560 Archive Collected Data

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1614 System Location Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

stealth

T1218 System Binary Proxy Execution

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in TELEPUZ: New Modular Malware-as-a-Service Distributed via

  • Microsoft — Windows (desktop/workstation)
    Vulnerable versions: All supported Windows versions targeted via social engineering, not a software vulnerability

Remediation for TELEPUZ: New Modular Malware-as-a-Service Distributed via

Immediate actions

  • Block outbound traffic to identified TELEPUZ staging and C2 domains (cal.joycedoula.com.br, cal.snehamumbai.org, hurgadatour.shop, memshowblob.forum, and the rotating staging domain list)
  • Deploy the Elastic YARA rule Windows_Trojan_Telepuz.yar across endpoint and file-scanning infrastructure
  • Alert on rundll32.exe spawning from a freshly downloaded DLL in %TEMP%/%AppData%/%ProgramData%
  • Alert on PowerShell processes launched with -NoP -w h -ep bypass flag combinations from clipboard-paste or Run-dialog origin

Workarounds

  • Restrict clipboard-to-Run/PowerShell paste-and-execute workflows via Group Policy where feasible
  • Disable or tightly scope non-essential outbound WebSocket connections from endpoints to unclassified domains

Longer-term hardening

  • Deploy EDR with kernel-callback or ETW-independent telemetry capable of detecting AMSI/ETW patching and NTDLL unhooking
  • Enforce application allow-listing / Attack Surface Reduction rules restricting rundll32.exe and PowerShell execution policy bypass
  • User awareness training specifically targeting ClickFix / 'paste this command to fix the issue' social-engineering lures
  • Monitor for anomalous Windows service creation with generic/system-sounding names and unsigned service binaries

Timeline of TELEPUZ: New Modular Malware-as-a-Service Distributed via

  • TELEPUZ campaign activity begins, evidenced by earliest Telegram fallback channel registration and Polygon smart-contract dead-drop resolver deployment
  • First TELEPUZ sample submitted to VirusTotal
  • Staging domain chubrik[.]sbs first observed distributing telepuz.dll
  • Staging domain mavpaprokla[.]lat first observed distributing telepuz.dll
  • Staging domain bigblower[.]click first observed distributing telepuz.dll
  • Staging domain hardenedom[.]shop first observed distributing telepuz.dll
  • Staging domain netblokirovka[.]asia first observed distributing telepuz.dll
  • VirusTotal submissions of TELEPUZ samples spike, indicating high daily build volume and active operator development
  • Staging domain mazaporka[.]shop first observed distributing telepuz.dll
  • Staging domain zewaplus[.]club first observed distributing telepuz.dll
  • Elastic Security Labs publishes full technical analysis of TELEPUZ MaaS, including C2 infrastructure, 36-command dispatch table, and YARA detection rule Windows_Trojan_Telepuz.yar

Sources cited for TELEPUZ: New Modular Malware-as-a-Service Distributed via

Threats related to TELEPUZ: New Modular Malware-as-a-Service Distributed via

Detection coverage for TL-2026-1386

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1386 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1386

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats