TELEPUZ: Modular MaaS Banking WebInjector Distributed via ClickFix/VIDAR Chain
TELEPUZ: Modular MaaS Banking WebInjector Distributed via (TL-2026-1557), also tracked as TELEPUZ, is a high-severity malware campaign, first published 2026-07-20. It has no confirmed attribution, affects Google Chrome / Chromium-based browsers, maps to 35 MITRE ATT&CK techniques (T1027, T1033, T1036), and is covered by 9 detection rules and 54 indicators of compromise.
Key facts for TL-2026-1557
- Threat ID
- TL-2026-1557
- Also known as
- TELEPUZ
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, retail-banking-customers
- Target regions
- brazil, india, Global
- Detection rules
- 9
- Indicators of compromise
- 54
Malware and tooling in TELEPUZ: Modular MaaS Banking WebInjector Distributed via
Malware and tooling: TELEPUZ, Vidar, Chrome DevTools Protocol, Polygon smart contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, WebDriver BiDi
TELEPUZ is a modular, 64-bit C-language DLL malware operated as a likely Malware-as-a-Service (MaaS) platform. It is distributed via ClickFix social-engineering lures that trigger PowerShell execution of a Go-variant VIDAR downloader, which drops the TELEPUZ install.exe stager and telepuz.dll main payload. TELEPUZ steals browser cookies, logs keystrokes, executes arbitrary commands, and deploys a WebInjector module that manipulates live banking sessions via Chrome DevTools Protocol / WebDriver BiDi, including real-time IBAN field swapping to redirect funds.
How TELEPUZ: Modular MaaS Banking WebInjector Distributed via works
TELEPUZ is a lightweight, modular malware family written in C, first observed spreading in the wild since late April 2026 and submitted to VirusTotal starting May 2, 2026, per Elastic Security Labs research. The infection chain begins with a ClickFix social-engineering lure — deceptive fake CAPTCHA/verification web content that tricks victims into pasting and executing a malicious PowerShell command themselves. That PowerShell command retrieves a Go-language variant of the VIDAR infostealer/downloader from staging infrastructure such as memshowblob[.]forum/api/index.php?a=grab. VIDAR then downloads and executes the TELEPUZ stager (install.exe, ~13-15KB) which in turn fetches and loads the main payload (telepuz.dll) via rundll32.exe, staged from domains such as hurgadatour[.]shop and mavpaprokla[.]lat.
Once resident, TELEPUZ establishes persistence via Windows service creation (registry keys under HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator and PilotmasterMast) and drops copies into deceptively named AppData/ProgramData paths (e.g., etwhost.dll, systemreset.dll, dsp_agent.dll) to blend with legitimate system components. It escalates privileges through a COM elevation moniker (ShellExecute UAC bypass) and an AppInfo ALPC + DebugObjects technique, then steals access tokens from privileged processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe) to operate at SYSTEM.
TELEPUZ implements extensive anti-analysis tradecraft: NTDLL unhooking, AMSI (AmsiScanBuffer) and ETW (EtwEventWrite, NtTraceEvent, NtTraceEventControl) patching, DLL notification-callback removal, hardware/VM fingerprinting (CPU count, RAM, disk size, hypervisor device-name checks), sandbox username/computer-name blocklists, multi-layer debugger detection (NtQueryInformationProcess, hardware breakpoints, ThreadHideFromDebugger, PEB.BeingDebugged, and a deliberate NtClose(0xDEADBEEF) crash-on-debug), and CIS-country geofencing via LCID validation. Obfuscation includes garbage-instruction interleaving, custom rotate/XOR import hashing, per-sample RC4 string encryption, and indirect syscalls executed through trampoline stubs patched into unrelated system DLLs (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, secur32.dll).
Command and control runs primarily over a manually implemented WebSocket protocol (optional TLS via SChannel) to a rotating set of C2 domains (cal.joycedoula[.]com[.]br, cal.snehamumbai[.]org — largely compromised legitimate sites in Brazil and India, fronted by Cloudflare). Session identifiers are derived from hardware serial, computer name, and OS install date via FNV1-32 hashing and a custom ROR27 algorithm. If the primary C2 becomes unreachable, TELEPUZ falls back through four redundant resolution channels: a Telegram profile (t.me/chanadarkpart, XOR-keyed with 'Goodman'), a Steam Community profile (76561199705801219), plain DNS queries (codebasecode[.]com), and reads from a Polygon blockchain smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) decrypted with a hardcoded AES-256-CBC key — giving the operators takedown-resistant, decentralized C2 resolution.
TELEPUZ supports 36+ hashed commands covering file operations, process enumeration/kill, screenshot capture, privilege escalation/token theft, and — critically — on-demand loading of three malicious modules over the same C2 channel: a keylogger, an infostealer (including a dedicated Chrome-cookie extraction routine using a downloaded 'Chrome elevator' helper), and the WebInjector. The WebInjector is a separate PE that communicates with the TELEPUZ core over STDIN/STDOUT/STDERR pipes and receives its JSON configuration over STDIN. Rather than hooking or injecting into the browser process, it drives Chromium browsers remotely via the Chrome DevTools Protocol (attaching to debug ports 9222-9229) and Firefox via the WebDriver BiDi protocol. Its default configuration performs real-time man-in-the-browser banking fraud: URL-matched interception of banking-site network traffic, request/response-stage filtering, and rule-based swapping of form fields — most notably IBAN and payment-amount fields — to silently redirect transferred funds to attacker-controlled accounts, along with general cookie theft and arbitrary JavaScript execution in the page context.
Steady daily build volume on VirusTotal, incrementally increasing binary size, and consistent development cadence point to active, ongoing development by a small team or solo developer operating TELEPUZ as a MaaS offering to other criminal affiliates who use ClickFix/VIDAR-style loaders to seed victims. Elastic Security Labs published a YARA detection rule (Windows_Trojan_Telepuz.yar) and a string-decryption IDA script (decrypt_stringv2.py) alongside their analysis. No CVE applies — this is malware/infostealer tooling, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1557
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1134 Access Token Manipulation; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1614 System Location Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1569 System Services
stealth
T1070 Indicator Removal; T1218 System Binary Proxy Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
command-and-control
Persistence
T1112 Modify Registry; T1543 Create or Modify System Process
Collection
T1113 Screen Capture; T1185 Browser Session Hijacking; T1560 Archive Collected Data
Privilege Escalation
T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Initial Access
defense-impairment
Affected products and versions in TELEPUZ: Modular MaaS Banking WebInjector Distributed via
- Google — Chrome / Chromium-based browsers
Vulnerable versions: all versions exposing Chrome DevTools Protocol debug ports - Mozilla — Firefox
Vulnerable versions: all versions supporting WebDriver BiDi - Microsoft — Windows (all supported desktop versions)
Vulnerable versions: all
Remediation for TELEPUZ: Modular MaaS Banking WebInjector Distributed via
Immediate actions
- Block all known TELEPUZ/VIDAR staging and C2 domains and IPs at DNS/proxy/firewall layer
- Block outbound WebSocket connections to /cdn/health?sid= and /ws/inject?cid= URI patterns on unapproved domains
- Alert on rundll32.exe loading telepuz.dll or DLLs from AppData/ProgramData paths mimicking system telemetry components
- Alert on and block PowerShell execution originating from browser paste-and-run (ClickFix) patterns
- Hunt for the CipherAllocator and PilotmasterMast service names and Software\Microsoft\VisualStudio\Telemetry marker registry key
- Deploy the Elastic YARA rule Windows_Trojan_Telepuz.yar across EDR/AV
- Force re-authentication and review recent outbound wire/IBAN transfers on hosts showing TELEPUZ IOCs
Workarounds
- Restrict PowerShell execution policy and log ScriptBlock/Module logging to catch ClickFix-driven command execution
- Disable or tightly control remote debugging port exposure on managed Chrome/Firefox deployments
Longer-term hardening
- Deploy browser isolation or DOM-integrity monitoring for online banking portals to detect CDP/WebDriver BiDi remote-control sessions
- Implement out-of-band transaction verification (SMS/app confirmation showing true destination IBAN) for consumer and business banking
- Harden endpoint policy to block unsigned/unexpected use of Chrome remote-debugging ports (9222-9229)
- User awareness training specifically targeting ClickFix / fake-CAPTCHA 'paste this into Run' social engineering
- Deploy AMSI/ETW tamper-detection telemetry and alert on AmsiScanBuffer/EtwEventWrite patch signatures
- Monitor for anomalous Telegram/Steam-profile/DNS-TXT/blockchain-RPC lookups from endpoint processes as C2 fallback indicators
Timeline of TELEPUZ: Modular MaaS Banking WebInjector Distributed via
- TELEPUZ Telegram fallback channel (t.me/chanadarkpart) created, marking earliest known operational infrastructure setup.
- First TELEPUZ sample submitted to VirusTotal, per Elastic Security Labs telemetry.
- First staging/distribution domain chubrik[.]sbs observed serving TELEPUZ DLL payload.
- Distribution domain mavpaprokla[.]lat begins serving payload under the now-standard telepuz.dll filename and /files/telemetriawork/ path pattern.
- Staging domain momasites[.]lol observed; rapid rotation of near-identical typosquat-style staging domains (momasites/mamsites/hardenedom family) begins.
- Staging infrastructure observed served directly from IP 172.67.215[.]214 rather than domain, alongside continued domain rotation (netblokirovka family).
- hurgadatour[.]shop begins serving telepuz.dll; later cited by GBHackers as a primary current staging domain for the VIDAR-delivered stager.
- zewaplus[.]club observed serving telepuz.dll payload.
- Latest indexed staging IP 172.67.165[.]144 observed serving telepuz.dll, the most recent IOC in Elastic's published dataset.
- GBHackers and The Hacker News publish summary coverage of the Elastic Security Labs TELEPUZ research on the same day as disclosure.
- Elastic Security Labs publishes full technical analysis 'TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains,' including YARA rule and IDA decryption script.
- Sharp increase in TELEPUZ-related VirusTotal submissions observed starting early June 2026, per Elastic Security Labs, consistent with expanded MaaS distribution.
Sources cited for TELEPUZ: Modular MaaS Banking WebInjector Distributed via
Threats related to TELEPUZ: Modular MaaS Banking WebInjector Distributed via
- TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain
- ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage
- TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
Detection coverage for TL-2026-1557
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1557 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1557
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.