TELEPUZ is a lightweight, modular malware-as-a-service (MaaS) platform written in C, first observed propagating in the wild in late April 2026 and reverse-engineered by Cyril François of Elastic Security Labs (published 2026-07-16). The infection chain begins with a ClickFix social-engineering lure on a compromised or attacker-controlled website: the victim is presented with a fake CAPTCHA, browser-update, or content-access prompt that has silently copied a malicious command to the clipboard, and is instructed to paste and run it via the Windows Run dialog or PowerShell. The resulting PowerShell command (using obfuscated flags '-NoP -w h -ep bypass' and string-concatenated 'Down'+'loadFile') retrieves a binary from hxxps://memshowblob[.]forum/api/index.php?a=grab into %TEMP% and executes it.

That first-stage binary is a Go-language rewrite of the well-known Vidar Stealer (sample hash 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954), which independently harvests host and browser data and then fetches a small (13-15 KB) TELEPUZ stager PE (hash 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) from hurgadatour[.]shop. The stager downloads the main 64-bit TELEPUZ.dll payload and launches it via rundll32.exe using disguised export names, sharing string-encryption and import-hashing routines with the main payload to confirm family linkage.

Once loaded, TELEPUZ performs extensive anti-analysis: VM/hypervisor detection (CPU count, RAM, disk space, hypervisor device names), CIS-region geofencing via LCID checks (blocking Ukrainian, Belarusian, Armenian, Azerbaijani, Tajik, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Moldovan locales), sandbox/researcher username and hostname blocklists, and debugger detection (NtQueryInformationProcess, hardware breakpoints, ThreadHideFromDebugger, NtClose(0xDEADBEEF) crash-the-debugger trick, PEB.BeingDebugged). It then patches AMSI (AmsiScanBuffer -> E_INVALIDARG), disables ETW (EtwEventWrite/NtTraceEvent stubs), unhooks NTDLL, removes DLL-notification callbacks, and executes syscalls indirectly via patched trampolines planted in legitimate system DLLs (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, secur32.dll) to evade EDR hooking.

Privilege escalation uses either a COM-elevation/ShellExecute UAC bypass or an AppInfo ALPC/DebugObjects technique that hijacks a debug-object handle from an elevated auto-elevating binary (computerdefault.exe) to spawn an elevated rundll32.exe; SYSTEM-level access is obtained by stealing tokens from spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe. Persistence is installed as a Windows service named 'CipherAllocator' hosted in svchost.exe, with DLL fallback paths under masquerading folder names (DCFG\Runtime\Themes\Processor, StateRepository\Host\Recovery, XeroxPrint\Temp\Worker, Jundrax\Tracker).

C2 communication is over WebSocket (optionally TLS via SChannel) to a path '/cdn/health?sid=<SESSION_ID>' where the session ID is derived from hardware serial, computer name, and OS install date via FNV1_32 and a custom ROR27 hash. Commands are hashed with a DJB2-style algorithm and dispatched across 36 distinct capabilities including keylogging, screenshotting, Chrome cookie extraction via a downloaded 'chromeelevator' helper, process hollowing into dllhost.exe, arbitrary module loading, and a browser web-injection module. Primary C2 domains are cal.joycedoula[.]com[.]br (earliest, April 2026) and cal.snehamumbai[.]org (current), both apparently compromised legitimate sites in Brazil and India, fronted by Cloudflare.

TELEPUZ implements four independent dead-drop resolvers for C2 fallback: a Telegram channel (t[.]me/chanadarkpart, created ~2026-04-27/29) with XOR-key 'Goodman' encrypted addresses; a Steam Community profile (steamcommunity[.]com/profiles/76561199705801219) whose display name embeds an alternate XOR-key ('111111111') encrypted address; a DNS TXT dead-drop at codebasecode[.]com (no records observed to date); and a Polygon blockchain smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, method selector 0xc3f909d4) whose JSON-RPC response is AES-256-CBC decrypted to yield 'h=cal.snehamumbai[.]org|p=443|ssl=1', with a built-in kill-switch (a response under 10 bytes triggers ExitThread).

The WebInjector module implements true man-in-the-browser capability: it attaches to Chrome via the Chrome DevTools Protocol (scanning debug ports 9222-9229) and to Firefox via a WebDriver BiDi equivalent, injecting JavaScript SDK payloads (up to 65 KB) to intercept page loads, swap form fields (notably IBAN/bank-transfer fields), and steal cookies/session data in real time, optionally proxying stolen data directly to the C2 over a dedicated '/ws/inject?cid=' channel.

Infrastructure evolved rapidly: distribution domains rotated at least every few days from May through July 2026 (chubrik[.]sbs, betalegenda[.]cfd, mavpaprokla[.]lat, comicstar[.]lat, bigblower[.]click, momasites[.]lol/.com, mamsites[.]lol, hardenedom/hardendom/hardeneddom[.]shop, netblokirovka/netblokir/netlobikrovka[.]asia, neblokirovka[.]as, kidsko[.]shop, mazaporka[.]shop, hurgadatour[.]shop, krabsburger[.]xyz, zewaplus[.]club, plus two bare Cloudflare-fronted IPs 172.67.215.214 and 172.67.165.144), all serving payloads under a standardized '/files/telemetriawork/telepuz.dll' path (early builds used randomized paths). Daily VirusTotal build submissions, the small number of live C2 domains, and code-quality/feature-completeness indicators (e.g. an unimplemented InjectShellcode command) point to a small team or solo developer actively iterating a nascent MaaS offering rather than a mature, widely-resold crimeware kit.