# TELEPUZ: Modular MaaS Banking WebInjector Distributed via ClickFix/VIDAR Chain

> TELEPUZ is a modular, 64-bit C-language DLL malware operated as a likely Malware-as-a-Service (MaaS) platform. It is distributed via ClickFix social-engineering lures that trigger PowerShell execution of a Go-variant VIDAR downloader, which drops the TELEPUZ install.exe stager and telepuz.dll main payload. TELEPUZ steals browser cookies, logs keystrokes, executes arbitrary commands, and deploys a WebInjector module that manipulates live banking sessions via Chrome DevTools Protocol / WebDriver BiDi, including real-time IBAN field swapping to redirect funds.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1557
- **ID:** TL-2026-1557
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 54 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TELEPUZ is a lightweight, modular malware family written in C, first observed spreading in the wild since late April 2026 and submitted to VirusTotal starting May 2, 2026, per Elastic Security Labs research. The infection chain begins with a ClickFix social-engineering lure — deceptive fake CAPTCHA/verification web content that tricks victims into pasting and executing a malicious PowerShell command themselves. That PowerShell command retrieves a Go-language variant of the VIDAR infostealer/downloader from staging infrastructure such as memshowblob[.]forum/api/index.php?a=grab. VIDAR then downloads and executes the TELEPUZ stager (install.exe, ~13-15KB) which in turn fetches and loads the main payload (telepuz.dll) via rundll32.exe, staged from domains such as hurgadatour[.]shop and mavpaprokla[.]lat.

Once resident, TELEPUZ establishes persistence via Windows service creation (registry keys under HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator and PilotmasterMast) and drops copies into deceptively named AppData/ProgramData paths (e.g., etwhost.dll, systemreset.dll, dsp_agent.dll) to blend with legitimate system components. It escalates privileges through a COM elevation moniker (ShellExecute UAC bypass) and an AppInfo ALPC + DebugObjects technique, then steals access tokens from privileged processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe) to operate at SYSTEM.

TELEPUZ implements extensive anti-analysis tradecraft: NTDLL unhooking, AMSI (AmsiScanBuffer) and ETW (EtwEventWrite, NtTraceEvent, NtTraceEventControl) patching, DLL notification-callback removal, hardware/VM fingerprinting (CPU count, RAM, disk size, hypervisor device-name checks), sandbox username/computer-name blocklists, multi-layer debugger detection (NtQueryInformationProcess, hardware breakpoints, ThreadHideFromDebugger, PEB.BeingDebugged, and a deliberate NtClose(0xDEADBEEF) crash-on-debug), and CIS-country geofencing via LCID validation. Obfuscation includes garbage-instruction interleaving, custom rotate/XOR import hashing, per-sample RC4 string encryption, and indirect syscalls executed through trampoline stubs patched into unrelated system DLLs (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, secur32.dll).

Command and control runs primarily over a manually implemented WebSocket protocol (optional TLS via SChannel) to a rotating set of C2 domains (cal.joycedoula[.]com[.]br, cal.snehamumbai[.]org — largely compromised legitimate sites in Brazil and India, fronted by Cloudflare). Session identifiers are derived from hardware serial, computer name, and OS install date via FNV1-32 hashing and a custom ROR27 algorithm. If the primary C2 becomes unreachable, TELEPUZ falls back through four redundant resolution channels: a Telegram profile (t.me/chanadarkpart, XOR-keyed with 'Goodman'), a Steam Community profile (76561199705801219), plain DNS queries (codebasecode[.]com), and reads from a Polygon blockchain smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) decrypted with a hardcoded AES-256-CBC key — giving the operators takedown-resistant, decentralized C2 resolution.

TELEPUZ supports 36+ hashed commands covering file operations, process enumeration/kill, screenshot capture, privilege escalation/token theft, and — critically — on-demand loading of three malicious modules over the same C2 channel: a keylogger, an infostealer (including a dedicated Chrome-cookie extraction routine using a downloaded 'Chrome elevator' helper), and the WebInjector. The WebInjector is a separate PE that communicates with the TELEPUZ core over STDIN/STDOUT/STDERR pipes and receives its JSON configuration over STDIN. Rather than hooking or injecting into the browser process, it drives Chromium browsers remotely via the Chrome DevTools Protocol (attaching to debug ports 9222-9229) and Firefox via the WebDriver BiDi protocol. Its default configuration performs real-time man-in-the-browser banking fraud: URL-matched interception of banking-site network traffic, request/response-stage filtering, and rule-based swapping of form fields — most notably IBAN and payment-amount fields — to silently redirect transferred funds to attacker-controlled accounts, along with general cookie theft and arbitrary JavaScript execution in the page context.

Steady daily build volume on VirusTotal, incrementally increasing binary size, and consistent development cadence point to active, ongoing development by a small team or solo developer operating TELEPUZ as a MaaS offering to other criminal affiliates who use ClickFix/VIDAR-style loaders to seed victims. Elastic Security Labs published a YARA detection rule (Windows_Trojan_Telepuz.yar) and a string-decryption IDA script (decrypt_stringv2.py) alongside their analysis. No CVE applies — this is malware/infostealer tooling, not a software vulnerability.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1129 Shared Modules
- T1569 System Services
- T1218 System Binary Proxy Execution
- T1543 Create or Modify System Process
- T1112 Modify Registry
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1134 Access Token Manipulation
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1614 System Location Discovery
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1070 Indicator Removal
- T1566 Phishing

## Sources

- [TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains](https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix)
- [TELEPUZ Web Injector Malware Analysis](https://gbhackers.com/telepuz-web-injector/)
- [New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands](https://thehackernews.com/2026/07/new-telepuz-malware-spreads-via.html)
- [Elastic Security Labs releases (YARA rules, IDA scripts)](https://github.com/elastic/labs-releases)
- [Elastic Security Labs](https://www.elastic.co/security-labs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1557