TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain — Threadlinqs Intelligence
As of 2026-07-16, TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 49 indicators of compromise.
Threat ID: TL-2026-1420 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
TELEPUZ is a modular, MaaS malware written in C that has been distributed since late April 2026 via ClickFix clipboard-hijacking lures on compromised websites. The three-stage infection chain
TELEPUZ is a lightweight, modular malware-as-a-service (MaaS) platform written in C, first observed propagating in the wild in late April 2026 and reverse-engineered by Cyril François of Elastic Security Labs (published 2026-07-16). The infection chain begins with a ClickFix social-engineering lure on a compromised or attacker-controlled website: the victim is presented with a fake CAPTCHA, browser-update, or content-access prompt that has silently copied a malicious command to the clipboard, and is instructed to paste and run it via the Windows Run dialog or PowerShell. The resulting PowerShell command (using obfuscated flags '-NoP -w h -ep bypass' and string-concatenated 'Down'+'loadFile') retrieves a binary from hxxps://memshowblob[.]forum/api/index.php?a=grab into %TEMP% and executes it.
That first-stage binary is a Go-language rewrite of the well-known Vidar Stealer (sample hash 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954), which independently harvests host and browser data and then fetches a small (13-15 KB) TELEPUZ stager PE (hash 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) from hurgadatour[.]shop. The stager downloads the main 64-bit TELEPUZ.dll payload and launches it via rundll32.exe using disguised export names, sharing string-encryption and import-hashing routines with the main payload to confirm family linkage.
Once loaded, TELEPUZ performs extensive anti-analysis: VM/hypervisor detection (CPU count, RAM, disk space, hypervisor device names), CIS-region geofencing via LCID checks (blocking Ukrainian, Belarusian, Armenian, Azerbaijani, Tajik, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Moldovan locales), sandbox/researcher username and hostname blocklists, and debugger detection (NtQueryInformationProcess, hardware breakpoints, ThreadHideFromDebugger, NtClose(0xDEADBEEF) crash-the-debugger trick, PEB.BeingDebugged). It then patches AMSI (AmsiScanBuffer -> E_INVALIDARG), disables ETW (EtwEventWrite/NtTraceEvent stubs), unhooks NTDLL, removes DLL-notification callbacks, and executes syscalls indirectly via patched trampolines planted in legitimate system DLLs (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, secur32.dll) to evade EDR hooking.
Privilege escalation uses either a COM-elevation/ShellExecute UAC bypass or an AppInfo ALPC/DebugObjects technique that hijacks a debug-object handle from an elevated auto-elevating binary (computerdefault.exe) to spawn an elevated rundll32.exe; SYSTEM-level access is obtained by stealing tokens from spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe. Persistence is installed as a Windows service named 'CipherAllocator' hosted in svchost.exe, with DLL fallback paths under masquerading folder names (DCFG\Runtime\Themes\Processor, StateRepository\Host\Recovery, XeroxPrint\Temp\Worker, Jundrax\Tracker).
C2 communication is over WebSocket (optionally TLS via SChannel) to a path '/cdn/health?sid=<SESSION_ID>' where the session ID is derived from hardware serial, computer name, and OS install date via FNV1_32 and a custom ROR27 hash. Commands are hashed with a DJB2-style algorithm and dispatched across 36 distinct capabilities including keylogging, screenshotting, Chrome cookie extraction via a downloaded 'chromeelevator' helper, process hollowing into dllhost.exe, arbitrary module loading, and a browser web-injection module. Primary C2 domains are cal.joycedoula[.]com[.]br (earliest, April 2026) and cal.snehamumbai[.]org (current), both apparently compromised legitimate sites in Brazil and India, fronted by Cloudflare.
TELEPUZ implements four independent dead-drop resolvers for C2 fallback: a Telegram channel (t[.]me/chanadarkpart, created ~2026-04-27/29) with XOR-key 'Goodman' encrypted addresses; a Steam Community profile (steamcommunity[.]com/profiles/76561199705801219) whose display name embeds an alternate XOR-key ('111111111') encrypted address; a DNS TXT dead-drop at codebasecode[.]com (no records observed to date); and a P
Target sectors: generalpublic, finance, consumer, smallbusiness
Target regions: Global (excluding CIS: Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 49 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1592, T1584, T1587, T1189, T1059, T1204, T1106, T1129, T1569, T1218