# TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering

> Elastic Security Labs identified TELEPUZ, a new modular malware-as-a-service (MaaS) platform distributed via ClickFix social engineering that tricks victims into executing an obfuscated PowerShell command. The command chain fetches a VIDAR Go loader which retrieves the TELEPUZ stager and main DLL payload, employing process hollowing, COM-elevation UAC bypass, NTDLL unhooking, AMSI/ETW patching, and indirect syscalls to evade detection.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1386
- **ID:** TL-2026-1386
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TELEPUZ is a newly identified, actively-developed modular malware-as-a-service platform documented by Elastic Security Labs, distributed since late April 2026 through ClickFix-style social engineering. Victims are lured to a malicious webpage that instructs them to paste and run an obfuscated PowerShell command (using `-NoP -w h -ep bypass` flags to disable the profile, hide the window, and bypass execution policy). This command downloads a VIDAR Go variant (SHA256 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954) from `hxxps://memshowblob[.]forum/api/index.php?a=grab`, which in turn retrieves the TELEPUZ third-stage stager (`install.exe`, a small ~13-15KB PE) and the main payload (`telepuz.dll`) from `hurgadatour[.]shop`.

The stager launches the main DLL via `rundll32.exe` using obfuscated export names. The DLL is a 64-bit Windows library built from lightweight, modular C code that masquerades as legitimate software; the codebase and build cadence (steady VirusTotal submissions since May 2, 2026 with a spike in June) suggest a small team or solo developer iterating rapidly on a commercial MaaS offering.

TELEPUZ's `DllMain` re-executes the malware via `rundll32.exe` unless already running as `svchost.exe` or `rundll32.exe`, then hands off to a `ServiceRoutine` entry point that installs persistence, initializes an indirect-syscall engine, performs anti-VM/anti-debug checks, escalates privileges, installs itself as a Windows service, and opens C2 communication.

Evasion is extensive: garbage-instruction obfuscation and custom import hashing complicate static analysis; strings are RC4-encrypted with per-sample keys; API calls are issued via indirect syscalls generated by mapping a fresh copy of `ntdll.dll`, parsing syscall numbers, and patching trampoline stubs into the `.text` sections of unrelated system DLLs (`dfscli.dll`, `davhlpr.dll`, `msdtclog.dll`, `dsrole.dll`, `secur32.dll`). The malware unhooks NTDLL by remapping a clean copy via `NtMapViewOfSection` and restoring patched bytes, patches `AmsiScanBuffer` to force an `E_INVALIDARG` return, and patches `EtwEventWrite`/`NtTraceEvent`/`NtTraceEventControl` to zero out ETW telemetry. It also strips non-Windows DLL-load-notification callbacks and performs extensive anti-debug checks (`NtQueryInformationProcess` debug-port/flags/object-handle checks, hardware breakpoint inspection via `NtGetContextThread`, `ThreadHideFromDebugger`, a deliberate `NtClose(0xDEADBEEF)` crash, and `PEB.BeingDebugged` inspection), sleeping indefinitely if a debugger is detected.

Privilege escalation bypasses UAC via a COM elevation moniker (creating an elevated COM object and invoking `ShellExecute`) or, alternatively, by launching `winver.exe` in debug mode through `RAicLaunchAdminProcess`, capturing its debug-object handle, launching auto-elevated `computerdefault.exe`, and attaching the captured handle via `DbgUiSetThreadDebugObject`. For SYSTEM-level access it steals tokens from `spoolsv.exe`, `msdtc.exe`, `WmiPrvSE.exe`, and `svchost.exe`.

Persistence migrates the payload from `%TEMP%` to `%AppData%`/`%ProgramData%` locations (observed paths include `%AppData%\Local\DCFG\Runtime\Themes\Processor\etwhost.dll`, `%AppData%\Roaming\StateRepository\Host\Recovery\systemreset.dll`, and `%ProgramData%\XeroxPrint\Temp\Worker\grpeng.dll`), creates the mutex `cfgmgr_mtx` (plus `bginfod_mtx` and `wfj64_mtx` in other components), and registers a Windows service (`CipherAllocator`, also seen as `PilotmasterMast`).

A per-host session ID is derived by combining the hardware serial, computer name, and OS install date through FNV1-32 and ROR27 hashing into a 16-character hex identifier. Anti-VM logic checks for low CPU/RAM/disk, blocks execution in CIS-region locales (Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova), compares hostnames/usernames against sandbox-indicative wordlists, and inspects display-device names for known hypervisor signatures.

C2 communication uses a WebSocket channel at `/cdn/health?sid=` (optionally TLS via SChannel) to domains `cal.joycedoula[.]com[.]br` (earliest configs) and `cal.snehamumbai[.]org` (latest), both believed to be compromised legitimate websites hosted in Brazil and India respectively. TELEPUZ ships a resilient, multi-layer fallback resolution chain if the primary C2 is unreachable: a Telegram profile (`t.me/chanadarkpart`) containing an XOR-encrypted (key "Goodman") fallback URL; a Steam profile (`steamcommunity.com/profiles/76561199705801219`) with an encrypted C2 address embedded in the username; a DNS TXT-style lookup against `codebasecode[.]com` (not yet observed in the wild); and a Polygon blockchain dead-drop resolver that issues JSON-RPC calls to smart contract `0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E`, AES-256-CBC decrypting the returned value with a hardcoded key and triggering a kill-switch if the decrypted result is under 10 bytes.

The C2 protocol supports 36 identified commands (hashed with a custom `0x1505` seed / `0x21*hash` XOR scheme) spanning reconnaissance (ListRunningProcesses, ListJobs, Screenshot), execution (ExecuteCommand, DownloadRunPE, DownloadRunModule, DownloadLoadMalwareModule, MigrateIntoProcess), credential/browser theft (ExtractChromeCookiesUsingDownloadedChromeElevator, StealProcessToken), keylogging (GetKeyLoggerStatus, KeyLoggerEnableDisableFormFlush), privilege escalation (ElevateToAdmin, ElevateToSystem), self-update/cleanup (UpdateMalware, Delete, Kill), and staged exfiltration (CreateZip, Upload). An `InjectShellcode` command exists but is unimplemented, returning "INJECT:TODO" — evidence of the platform's active, in-progress development.

TELEPUZ is genuinely modular: additional PE/DLL modules are fetched on demand, including a keylogger (`/static/modules/kMP6HBGEA8.bin`), a web-injector (`/static/modules/yaVaoS3Bw.bin`), a stealer (`/static/modules/W2UMxylgG_.bin`), and a Chrome cookie extractor leveraging the public Chrome-App-Bound-Encryption-Decryption technique (`/static/assets/chromeelevator.bin`). The web-injector communicates over STDIN/STDOUT/STDERR and drives the Chrome DevTools Protocol (for Chromium browsers) or WebDriver BiDi (for Firefox) to swap banking form fields — specifically IBAN values — based on a JSON configuration of action definitions, intercept filters, and trigger conditions, indicating a financial-fraud monetization path alongside generic credential/cookie theft.

Elastic observed a steady staging-domain rotation cadence (roughly weekly new domains) since May 2026, and published a YARA detection rule (`Windows_Trojan_Telepuz.yar`) in its public protections-artifacts GitHub repository.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1218 System Binary Proxy Execution
- T1204 User Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1218 System Binary Proxy Execution
- T1622 Debugger Evasion
- T1036 Masquerading
- T1134 Access Token Manipulation
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1057 Process Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1021 Remote Services
- T1041 Exfiltration Over C2 Channel

## Sources

- [TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix](https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix)
- [Elastic protections-artifacts GitHub repository (Windows_Trojan_Telepuz.yar)](https://github.com/elastic/protections-artifacts)
- [ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure)
- [Australia warns of ClickFix attacks pushing Vidar Stealer malware](https://www.bleepingcomputer.com/news/security/australia-warns-of-clickfix-attacks-pushing-vidar-stealer-malware/)
- [MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites](https://www.elastic.co/security-labs/mimicrat-custom-rat-mimics-c2-frameworks)
- [Globally distributed stealers — Elastic Security Labs](https://www.elastic.co/security-labs/globally-distributed-stealers)
- [Chrome-App-Bound-Encryption-Decryption project (technique referenced by TELEPUZ Chrome cookie extractor)](https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1386