Threat reportMalwareTL-2026-1558
ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage
ClickFix Campaign Delivers TELEPUZ Modular RAT via (TL-2026-1558), also tracked as TELEPUZ, is a high-severity malware campaign, first published 2026-07-20. It has no confirmed attribution, affects Microsoft Windows, maps to 36 MITRE ATT&CK techniques (T1005, T1027, T1029), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 36MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-1558
- Threat ID
- TL-2026-1558
- Also known as
- TELEPUZ, CLICKFIX-VIDAR chain
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, general consumer enterprise broad opportunistic targeting
- Target regions
- Global (excludes CIS: Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, Moldova)
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in ClickFix Campaign Delivers TELEPUZ Modular RAT via
Malware and tooling: TELEPUZ, Vidar
How ClickFix Campaign Delivers TELEPUZ Modular RAT via works
Elastic Security Labs is tracking TELEPUZ, a modular malware-as-a-service RAT with 36 remote commands spread since late April 2026 via ClickFix clipboard-hijacking lures that pull a Go-based VIDAR variant, which in turn installs a TELEPUZ stager (install.exe) and main payload (telepuz.dll) via rundll32.exe. The malware supports Chromium/Firefox cookie theft, keylogging, web-injection via browser debugging protocols, process hollowing, UAC bypass and token theft, and falls back to Telegram, Steam, DNS, and a Polygon blockchain smart contract to recover its C2 address if primary domains are seized.
TELEPUZ is a lightweight, modular Windows RAT written in C, distributed under an apparent malware-as-a-service model evidenced by daily VirusTotal build submissions and steady binary-size growth since campaign onset. Victims are lured through fake browser/verification pages using the ClickFix social-engineering technique: a spoofed CAPTCHA or update prompt instructs the user to press Win+R and paste a clipboard-hijacked PowerShell command, which fetches a Go-based VIDAR variant from hurgadatour[.]shop. VIDAR downloads and executes two additional components: a small (~13-15KB) stager, install.exe, and the main 64-bit payload, telepuz.dll, launched via rundll32.exe. telepuz.dll establishes a WebSocket (optionally TLS-wrapped) connection to a primary C2 domain and communicates using a JSON-based protocol with a hashed 36-command set (XOR-based hashing, initial value 0x1505). Before beaconing, the malware performs extensive anti-analysis: hardware/resource checks (rejects <2 CPUs, <2GB RAM, low disk), CIS-country geofencing via LCID, sandbox/researcher username and computer-name blacklists, hypervisor display-device detection, NTDLL unhooking, AMSI/ETW patching, DLL notification-callback removal, and multi-layered debugger detection (including infinite-sleep on detection). Persistence is achieved by registering a Windows service (commonly named CipherAllocator, alternately PilotmasterMast) and dropping the DLL under disguised paths in %AppData% or %ProgramData%. Privilege escalation uses a COM elevation moniker, AppInfo ALPC abuse, and token theft from privileged system processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe). Core capabilities include file/process enumeration and manipulation, screenshot capture, keystroke logging, Chromium cookie extraction via a downloaded chromeelevator module, and a Chrome DevTools Protocol/WebDriver BiDi-based web-injection module that swaps form fields (e.g., IBAN substitution) on financial sites without traditional code injection. If primary WebSocket C2 domains are unreachable, TELEPUZ recovers a fallback address by decrypting content pulled from a Telegram channel (t.me/chanadarkpart, XOR key 'Goodman'), a Steam Community profile's name-history field, a DNS TXT-style lookup against codebasecode.com, or a Polygon blockchain smart contract (AES-256-CBC decryption), the last of which doubles as an operator-controlled kill switch. As of the July 2026 Elastic Security Labs disclosure the shellcode-injection command remained an unimplemented TODO, underscoring the malware's active, rapid development by what is assessed to be a small team or solo developer. This is the second ClickFix-delivered threat cluster Elastic has tracked in this timeframe, following SCMBANKER.
MITRE ATT&CK techniques used in TL-2026-1558
Collection
T1005 Data from Local System; T1074 Data Staged; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1055 Process Injection; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1614 System Location Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1203 Exploitation for Client Execution; T1204 User Execution; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in ClickFix Campaign Delivers TELEPUZ Modular RAT via
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server (64-bit)
Remediation for ClickFix Campaign Delivers TELEPUZ Modular RAT via
Immediate actions
- Block all published TELEPUZ/VIDAR staging domains and IPs at DNS/proxy/perimeter firewall
- Alert on and quarantine any process spawning rundll32.exe with an unusual DLL path under %AppData%\Local or %ProgramData%
- Hunt for the Windows service names CipherAllocator and PilotmasterMast and the registry key HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator
- Search endpoint telemetry for the mutexes cfgmgr_mtx, bginfod_mtx, wfj64_mtx and registry marker Software\Microsoft\VisualStudio\Telemetry
- Block outbound connections to t.me/chanadarkpart, steamcommunity.com/profiles/76561199705801219, codebasecode[.]com, and JsonRPC calls to Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E from endpoint/server subnets where not business-justified
- Force-reset credentials and revoke browser session cookies for any host exhibiting TELEPUZ IOCs
Workarounds
- Disable clipboard-to-Run-dialog paste via Group Policy / registry where feasible
- Restrict rundll32.exe execution via Windows Defender Application Control (WDAC) or AppLocker to signed, known DLLs only
Longer-term hardening
- Deploy EDR with behavioral detection for AMSI/ETW patching, NTDLL unhooking, and indirect syscall trampolines
- Implement application allow-listing to prevent unsigned/unexpected DLLs from loading via rundll32.exe
- User awareness training specifically covering ClickFix/clipboard-hijacking lures (fake CAPTCHA, fake browser-update, 'paste this to verify you are human' prompts)
- Restrict or monitor Win+R Run dialog and PowerShell execution triggered immediately after clipboard paste events
- Monitor for anomalous outbound WebSocket connections to non-corporate domains using the /cdn/health?sid= URL pattern
Timeline of ClickFix Campaign Delivers TELEPUZ Modular RAT via
- Earliest observed TELEPUZ campaign activity, evidenced by initial Telegram fallback channel and Polygon smart-contract configuration.
- Fallback Telegram channel t.me/chanadarkpart created for encrypted C2 recovery.
- First TELEPUZ sample submitted to VirusTotal, beginning a pattern of daily build uploads.
- Staging/distribution domain chubrik[.]sbs first observed hosting TELEPUZ payloads.
- Staging/distribution domain betalegenda[.]cfd becomes active in the campaign infrastructure rotation.
- Staging/distribution domain mavpaprokla[.]lat begins distributing TELEPUZ components.
- Additional staging domains comicstar[.]lat and bigblower[.]click deployed as the operator rotates infrastructure.
- Sharp increase in campaign activity and observed binary-size growth begins in early June 2026.
- Further staging domains (hardenedom[.]shop, netblokirovka[.]asia, kidsko[.]shop, mazaporka, zewaplus[.]club) activated between June 5-30 as part of continued infrastructure churn.
- Cloudflare-fronted IP 172.67.215.214 first observed hosting TELEPUZ staging infrastructure.
- Second Cloudflare-fronted IP 172.67.165.144 added to TELEPUZ staging infrastructure.
- Elastic Security Labs publishes technical analysis 'TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains', including 36-command list, C2 fallback chain, and IOCs.
- Shellcode-injection command remains an unimplemented TODO at time of disclosure, confirming the malware is still under active, rapid development.
- Cyber Security News and The Hacker News publish coverage summarizing the Elastic Security Labs findings.
Sources cited for ClickFix Campaign Delivers TELEPUZ Modular RAT via
Detection coverage for TL-2026-1558
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1558 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.