ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage
ClickFix Campaign Delivers TELEPUZ Modular RAT via (TL-2026-1558), also tracked as TELEPUZ, is a high-severity malware campaign, first published 2026-07-20. It has no confirmed attribution, affects Microsoft Windows, maps to 36 MITRE ATT&CK techniques (T1005, T1027, T1029), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-1558
- Threat ID
- TL-2026-1558
- Also known as
- TELEPUZ, CLICKFIX-VIDAR chain
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, general consumer enterprise broad opportunistic targeting
- Target regions
- Global (excludes CIS: Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova)
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in ClickFix Campaign Delivers TELEPUZ Modular RAT via
Malware and tooling: TELEPUZ, Vidar
Elastic Security Labs is tracking TELEPUZ, a modular malware-as-a-service RAT with 36 remote commands spread since late April 2026 via ClickFix clipboard-hijacking lures that pull a Go-based VIDAR variant, which in turn installs a TELEPUZ stager (install.exe) and main payload (telepuz.dll) via rundll32.exe. The malware supports Chromium/Firefox cookie theft, keylogging, web-injection via browser debugging protocols, process hollowing, UAC bypass and token theft, and falls back to Telegram, Steam, DNS, and a Polygon blockchain smart contract to recover its C2 address if primary domains are seized.
How ClickFix Campaign Delivers TELEPUZ Modular RAT via works
TELEPUZ is a lightweight, modular Windows RAT written in C, distributed under an apparent malware-as-a-service model evidenced by daily VirusTotal build submissions and steady binary-size growth since campaign onset. Victims are lured through fake browser/verification pages using the ClickFix social-engineering technique: a spoofed CAPTCHA or update prompt instructs the user to press Win+R and paste a clipboard-hijacked PowerShell command, which fetches a Go-based VIDAR variant from hurgadatour[.]shop. VIDAR downloads and executes two additional components: a small (~13-15KB) stager, install.exe, and the main 64-bit payload, telepuz.dll, launched via rundll32.exe. telepuz.dll establishes a WebSocket (optionally TLS-wrapped) connection to a primary C2 domain and communicates using a JSON-based protocol with a hashed 36-command set (XOR-based hashing, initial value 0x1505). Before beaconing, the malware performs extensive anti-analysis: hardware/resource checks (rejects <2 CPUs, <2GB RAM, low disk), CIS-country geofencing via LCID, sandbox/researcher username and computer-name blacklists, hypervisor display-device detection, NTDLL unhooking, AMSI/ETW patching, DLL notification-callback removal, and multi-layered debugger detection (including infinite-sleep on detection). Persistence is achieved by registering a Windows service (commonly named CipherAllocator, alternately PilotmasterMast) and dropping the DLL under disguised paths in %AppData% or %ProgramData%. Privilege escalation uses a COM elevation moniker, AppInfo ALPC abuse, and token theft from privileged system processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe). Core capabilities include file/process enumeration and manipulation, screenshot capture, keystroke logging, Chromium cookie extraction via a downloaded chromeelevator module, and a Chrome DevTools Protocol/WebDriver BiDi-based web-injection module that swaps form fields (e.g., IBAN substitution) on financial sites without traditional code injection. If primary WebSocket C2 domains are unreachable, TELEPUZ recovers a fallback address by decrypting content pulled from a Telegram channel (t.me/chanadarkpart, XOR key 'Goodman'), a Steam Community profile's name-history field, a DNS TXT-style lookup against codebasecode.com, or a Polygon blockchain smart contract (AES-256-CBC decryption), the last of which doubles as an operator-controlled kill switch. As of the July 2026 Elastic Security Labs disclosure the shellcode-injection command remained an unimplemented TODO, underscoring the malware's active, rapid development by what is assessed to be a small team or solo developer. This is the second ClickFix-delivered threat cluster Elastic has tracked in this timeframe, following SCMBANKER.
MITRE ATT&CK techniques used in TL-2026-1558
Collection
T1005 Data from Local System; T1074 Data Staged; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1055 Process Injection; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1614 System Location Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1203 Exploitation for Client Execution; T1204 User Execution; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in ClickFix Campaign Delivers TELEPUZ Modular RAT via
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server (64-bit)
Remediation for ClickFix Campaign Delivers TELEPUZ Modular RAT via
Immediate actions
- Block all published TELEPUZ/VIDAR staging domains and IPs at DNS/proxy/perimeter firewall
- Alert on and quarantine any process spawning rundll32.exe with an unusual DLL path under %AppData%\Local or %ProgramData%
- Hunt for the Windows service names CipherAllocator and PilotmasterMast and the registry key HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator
- Search endpoint telemetry for the mutexes cfgmgr_mtx, bginfod_mtx, wfj64_mtx and registry marker Software\Microsoft\VisualStudio\Telemetry
- Block outbound connections to t.me/chanadarkpart, steamcommunity.com/profiles/76561199705801219, codebasecode[.]com, and JsonRPC calls to Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E from endpoint/server subnets where not business-justified
- Force-reset credentials and revoke browser session cookies for any host exhibiting TELEPUZ IOCs
Workarounds
- Disable clipboard-to-Run-dialog paste via Group Policy / registry where feasible
- Restrict rundll32.exe execution via Windows Defender Application Control (WDAC) or AppLocker to signed, known DLLs only
Longer-term hardening
- Deploy EDR with behavioral detection for AMSI/ETW patching, NTDLL unhooking, and indirect syscall trampolines
- Implement application allow-listing to prevent unsigned/unexpected DLLs from loading via rundll32.exe
- User awareness training specifically covering ClickFix/clipboard-hijacking lures (fake CAPTCHA, fake browser-update, 'paste this to verify you are human' prompts)
- Restrict or monitor Win+R Run dialog and PowerShell execution triggered immediately after clipboard paste events
- Monitor for anomalous outbound WebSocket connections to non-corporate domains using the /cdn/health?sid= URL pattern
Timeline of ClickFix Campaign Delivers TELEPUZ Modular RAT via
- Earliest observed TELEPUZ campaign activity, evidenced by initial Telegram fallback channel and Polygon smart-contract configuration.
- Fallback Telegram channel t.me/chanadarkpart created for encrypted C2 recovery.
- First TELEPUZ sample submitted to VirusTotal, beginning a pattern of daily build uploads.
- Staging/distribution domain chubrik[.]sbs first observed hosting TELEPUZ payloads.
- Staging/distribution domain betalegenda[.]cfd becomes active in the campaign infrastructure rotation.
- Staging/distribution domain mavpaprokla[.]lat begins distributing TELEPUZ components.
- Additional staging domains comicstar[.]lat and bigblower[.]click deployed as the operator rotates infrastructure.
- Sharp increase in campaign activity and observed binary-size growth begins in early June 2026.
- Further staging domains (hardenedom[.]shop, netblokirovka[.]asia, kidsko[.]shop, mazaporka, zewaplus[.]club) activated between June 5-30 as part of continued infrastructure churn.
- Cloudflare-fronted IP 172.67.215.214 first observed hosting TELEPUZ staging infrastructure.
- Second Cloudflare-fronted IP 172.67.165.144 added to TELEPUZ staging infrastructure.
- Elastic Security Labs publishes technical analysis 'TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains', including 36-command list, C2 fallback chain, and IOCs.
- Shellcode-injection command remains an unimplemented TODO at time of disclosure, confirming the malware is still under active, rapid development.
- Cyber Security News and The Hacker News publish coverage summarizing the Elastic Security Labs findings.
Sources cited for ClickFix Campaign Delivers TELEPUZ Modular RAT via
Threats related to ClickFix Campaign Delivers TELEPUZ Modular RAT via
- TELEPUZ: Modular MaaS Banking WebInjector Distributed via ClickFix/VIDAR Chain
- TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain
- TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering
- ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com
- EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)
Detection coverage for TL-2026-1558
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1558 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.