# TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain

> TELEPUZ is a modular, MaaS malware written in C that has been distributed since late April 2026 via ClickFix clipboard-hijacking lures on compromised websites. The three-stage infection chain (ClickFix PowerShell → Vidar Stealer Go variant → TELEPUZ stager) deploys a 64-bit DLL loaded via rundll32.exe that provides operators with keylogging, screenshot capture, Chrome cookie theft, and direct in-browser control via Chrome DevTools Protocol and WebDriver BiDi.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1420
- **ID:** TL-2026-1420
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 49 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TELEPUZ is a lightweight, modular malware-as-a-service (MaaS) platform written in C, first observed propagating in the wild in late April 2026 and reverse-engineered by Cyril François of Elastic Security Labs (published 2026-07-16). The infection chain begins with a ClickFix social-engineering lure on a compromised or attacker-controlled website: the victim is presented with a fake CAPTCHA, browser-update, or content-access prompt that has silently copied a malicious command to the clipboard, and is instructed to paste and run it via the Windows Run dialog or PowerShell. The resulting PowerShell command (using obfuscated flags '-NoP -w h -ep bypass' and string-concatenated 'Down'+'loadFile') retrieves a binary from hxxps://memshowblob[.]forum/api/index.php?a=grab into %TEMP% and executes it.

That first-stage binary is a Go-language rewrite of the well-known Vidar Stealer (sample hash 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954), which independently harvests host and browser data and then fetches a small (13-15 KB) TELEPUZ stager PE (hash 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) from hurgadatour[.]shop. The stager downloads the main 64-bit TELEPUZ.dll payload and launches it via rundll32.exe using disguised export names, sharing string-encryption and import-hashing routines with the main payload to confirm family linkage.

Once loaded, TELEPUZ performs extensive anti-analysis: VM/hypervisor detection (CPU count, RAM, disk space, hypervisor device names), CIS-region geofencing via LCID checks (blocking Ukrainian, Belarusian, Armenian, Azerbaijani, Tajik, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Moldovan locales), sandbox/researcher username and hostname blocklists, and debugger detection (NtQueryInformationProcess, hardware breakpoints, ThreadHideFromDebugger, NtClose(0xDEADBEEF) crash-the-debugger trick, PEB.BeingDebugged). It then patches AMSI (AmsiScanBuffer -> E_INVALIDARG), disables ETW (EtwEventWrite/NtTraceEvent stubs), unhooks NTDLL, removes DLL-notification callbacks, and executes syscalls indirectly via patched trampolines planted in legitimate system DLLs (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, secur32.dll) to evade EDR hooking.

Privilege escalation uses either a COM-elevation/ShellExecute UAC bypass or an AppInfo ALPC/DebugObjects technique that hijacks a debug-object handle from an elevated auto-elevating binary (computerdefault.exe) to spawn an elevated rundll32.exe; SYSTEM-level access is obtained by stealing tokens from spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe. Persistence is installed as a Windows service named 'CipherAllocator' hosted in svchost.exe, with DLL fallback paths under masquerading folder names (DCFG\Runtime\Themes\Processor, StateRepository\Host\Recovery, XeroxPrint\Temp\Worker, Jundrax\Tracker).

C2 communication is over WebSocket (optionally TLS via SChannel) to a path '/cdn/health?sid=<SESSION_ID>' where the session ID is derived from hardware serial, computer name, and OS install date via FNV1_32 and a custom ROR27 hash. Commands are hashed with a DJB2-style algorithm and dispatched across 36 distinct capabilities including keylogging, screenshotting, Chrome cookie extraction via a downloaded 'chromeelevator' helper, process hollowing into dllhost.exe, arbitrary module loading, and a browser web-injection module. Primary C2 domains are cal.joycedoula[.]com[.]br (earliest, April 2026) and cal.snehamumbai[.]org (current), both apparently compromised legitimate sites in Brazil and India, fronted by Cloudflare.

TELEPUZ implements four independent dead-drop resolvers for C2 fallback: a Telegram channel (t[.]me/chanadarkpart, created ~2026-04-27/29) with XOR-key 'Goodman' encrypted addresses; a Steam Community profile (steamcommunity[.]com/profiles/76561199705801219) whose display name embeds an alternate XOR-key ('111111111') encrypted address; a DNS TXT dead-drop at codebasecode[.]com (no records observed to date); and a Polygon blockchain smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, method selector 0xc3f909d4) whose JSON-RPC response is AES-256-CBC decrypted to yield 'h=cal.snehamumbai[.]org|p=443|ssl=1', with a built-in kill-switch (a response under 10 bytes triggers ExitThread).

The WebInjector module implements true man-in-the-browser capability: it attaches to Chrome via the Chrome DevTools Protocol (scanning debug ports 9222-9229) and to Firefox via a WebDriver BiDi equivalent, injecting JavaScript SDK payloads (up to 65 KB) to intercept page loads, swap form fields (notably IBAN/bank-transfer fields), and steal cookies/session data in real time, optionally proxying stolen data directly to the C2 over a dedicated '/ws/inject?cid=' channel.

Infrastructure evolved rapidly: distribution domains rotated at least every few days from May through July 2026 (chubrik[.]sbs, betalegenda[.]cfd, mavpaprokla[.]lat, comicstar[.]lat, bigblower[.]click, momasites[.]lol/.com, mamsites[.]lol, hardenedom/hardendom/hardeneddom[.]shop, netblokirovka/netblokir/netlobikrovka[.]asia, neblokirovka[.]as, kidsko[.]shop, mazaporka[.]shop, hurgadatour[.]shop, krabsburger[.]xyz, zewaplus[.]club, plus two bare Cloudflare-fronted IPs 172.67.215.214 and 172.67.165.144), all serving payloads under a standardized '/files/telemetriawork/telepuz.dll' path (early builds used randomized paths). Daily VirusTotal build submissions, the small number of live C2 domains, and code-quality/feature-completeness indicators (e.g. an unimplemented InjectShellcode command) point to a small team or solo developer actively iterating a nascent MaaS offering rather than a mature, widely-resold crimeware kit.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1106 Native API
- T1129 Shared Modules
- T1569 System Services
- T1218 System Binary Proxy Execution
- T1543 Create or Modify System Process
- T1112 Modify Registry
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1614 System Location Discovery
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1102 Web Service
- T1008 Fallback Channels

## Sources

- [New TELEPUZ Malware Spreads via ClickFix Attacks](https://thehackernews.com/2026/07/new-telepuz-malware-spreads-via.html)
- [TELEPUZ MaaS Malware: CLICKFIX-VIDAR Attack Chain Analysis](https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix)
- [Elastic Security Labs — Author: Cyril François](https://www.elastic.co/security-labs/author/cyril-francois)
- [Australia warns of ClickFix attacks pushing Vidar Stealer malware](https://www.bleepingcomputer.com/news/security/australia-warns-of-clickfix-attacks-pushing-vidar-stealer-malware/)
- [ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure)
- [Vidar v1.5 in Go: same family, new language, heavy sandbox checks](https://www.derp.ca/research/vidar-go-sandbox-dead-drop/)
- [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [MITRE ATT&CK: System Binary Proxy Execution: Rundll32](https://attack.mitre.org/techniques/T1218/011/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1420