ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage

Key facts for TELEPUZ RAT VIDAR second stage

Detection coverage for TELEPUZ RAT VIDAR second stage

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1558 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CipherAllocator/PilotmasterMast Service Registration for TELEPUZ Persistence

Detects sc.exe or registry-based creation of the documented TELEPUZ persistence Windows services (CipherAllocator, PilotmasterMast) or the corresponding registry key HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator, plus rundll32.exe loading a DLL from a disguised %AppData%\Local or %ProgramData% path rather than System32 — covering both persistence and privilege escalation via UAC bypass/token theft precursors.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1543, T1218, T1547, T1548, T1134, T1055
• Data sources: sysmon, windows_security, windows_registry_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=13)
| eval svc_hit=if(match(CommandLine, "(?i)(cipherallocator|pilotmastermast)"), 1, 0)
| eval reg_hit=if(match(TargetObject, "(?i)services\\\\cipherallocator"), 1, 0)
| eval rundll_hit=if(Image LIKE "%\\rundll32.exe" AND (match(CommandLine, "(?i)\\\\appdata\\\\local\\\\") OR match(CommandLine, "(?i)\\\\programdata\\\\")), 1, 0)
| where svc_hit=1 OR reg_hit=1 OR rundll_hit=1
| table _time, ComputerName, User, Image, CommandLine, TargetObject, EventCode
| sort - _time

Microsoft KQL

union DeviceProcessEvents, DeviceRegistryEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("sc.exe") and (ProcessCommandLine has "CipherAllocator" or ProcessCommandLine has "PilotmasterMast"))
   or (RegistryKey has @"Services\CipherAllocator")
   or (FileName =~ "rundll32.exe" and (ProcessCommandLine has @"\AppData\Local\" or ProcessCommandLine has @"\ProgramData\"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, RegistryKey, ActionType
| order by Timestamp desc

Sigma

title: Windows Service Registration Matching TELEPUZ Persistence Names or Disguised Rundll32 DLL Path
id: 4c8a1e6d-9b2f-4a7c-b3d5-2f6e8a1c9d40
status: experimental
description: Detects registration of the documented TELEPUZ persistence service names (CipherAllocator, PilotmasterMast) via sc.exe, the corresponding registry key, or rundll32.exe loading a DLL from a non-System32 %AppData%/%ProgramData% path consistent with telepuz.dll deployment.
references:
    - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
    - https://github.com/elastic/protections-artifacts
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-20
tags:
    - attack.persistence
    - attack.t1543.003
    - attack.defense-evasion
    - attack.t1218.011
    - attack.tool.telepuz
logsource:
    product: windows
    category: process_creation
detection:
    selection_svc:
        Image|endswith: '\\sc.exe'
        CommandLine|contains: 'create'
        CommandLine|contains:
            - 'CipherAllocator'
            - 'PilotmasterMast'
    selection_rundll:
        Image|endswith: '\\rundll32.exe'
        CommandLine|contains:
            - '\\AppData\\Local\\'
            - '\\ProgramData\\'
    condition: selection_svc or selection_rundll
falsepositives:
    - Legitimate third-party services using generic or similarly-obfuscated naming conventions
    - Enterprise software that legitimately loads DLLs via rundll32.exe from %ProgramData% (rare, should be allow-listed)
level: high

Known false positives:

• Rare legitimate enterprise deployments that name services similarly or load vendor DLLs via rundll32.exe from ProgramData

Tuning notes: Add an allow-list of known-good ProgramData/AppData rundll32 targets from your software inventory; alert on start=disabled services immediately followed by a start-type change, which indicates staged activation.

• 🔒 VIDAR-Stage Payload Retrieval from TELEPUZ Distribution/Staging Infrastructure · unlock with TL Creds
• 🔒 Chromium Cookie/Credential Theft via chromeelevator-Style Module and Token Theft from Privileged Processes · unlock with TL Creds
• 🔒 TELEPUZ Primary C2 Domain and WebSocket /cdn/health?sid= Beacon Pattern · unlock with TL Creds
• 🔒 ClickFix-Style Explorer-to-PowerShell Execution (Sigma Primary) · unlock with TL Creds
• 🔒 TELEPUZ Persistence Service Names and Disguised Rundll32 DLL Path (Sigma Primary) · unlock with TL Creds
• 🔒 TELEPUZ Multi-Tier Dead-Drop C2 Fallback Resolution (Telegram/Steam/DNS/Polygon) (Sigma Primary) · unlock with TL Creds
• 🔒 ClickFix Clipboard-Paste Lure Spawning PowerShell from Explorer (TELEPUZ Initial Access) · unlock with TL Creds
• 🔒 Anti-Analysis Marker Cluster: TELEPUZ Mutexes with VisualStudio Telemetry Registry Key · unlock with TL Creds

Indicators of compromise for TELEPUZ RAT VIDAR second stage

As of 2026-07-20, Threadlinqs Intelligence tracks 34 indicators of compromise for TL-2026-1558.

Sample indicators (3 of 34)

• IP address: 172.67.215[.]214
• Domain: hurgadatour[.]shop
• URL: hxxps://memshowblob[.]forum/api/index.php?a=grab

Defanged, TLP:CLEAR. Full set of 34 indicators: unlock with TL Creds.

How TELEPUZ RAT VIDAR second stage works

The malware supports Chromium/Firefox cookie theft, keylogging, web-injection via browser debugging protocols, process hollowing, UAC bypass and token theft, and falls back to Telegram, Steam, DNS, and a Polygon blockchain smart contract to recover its C2 address if primary domains are seized.

TELEPUZ is a lightweight, modular Windows RAT written in C, distributed under an apparent malware-as-a-service model evidenced by daily VirusTotal build submissions and steady binary-size growth since campaign onset. Victims are lured through fake browser/verification pages using the ClickFix social-engineering technique: a spoofed CAPTCHA or update prompt instructs the user to press Win+R and paste a clipboard-hijacked PowerShell command, which fetches a Go-based VIDAR variant from hurgadatour[.]shop. VIDAR downloads and executes two additional components: a small (~13-15KB) stager, install.exe, and the main 64-bit payload, telepuz.dll, launched via rundll32.exe. telepuz.dll establishes a WebSocket (optionally TLS-wrapped) connection to a primary C2 domain and communicates using a JSON-based protocol with a hashed 36-command set (XOR-based hashing, initial value 0x1505). Before beaconing, the malware performs extensive anti-analysis: hardware/resource checks (rejects <2 CPUs, <2GB RAM, low disk), CIS-country geofencing via LCID, sandbox/researcher username and computer-name blacklists, hypervisor display-device detection, NTDLL unhooking, AMSI/ETW patching, DLL notification-callback removal, and multi-layered debugger detection (including infinite-sleep on detection). Persistence is achieved by registering a Windows service (commonly named CipherAllocator, alternately PilotmasterMast) and dropping the DLL under disguised paths in %AppData% or %ProgramData%. Privilege escalation uses a COM elevation moniker, AppInfo ALPC abuse, and token theft from privileged system processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe). Core capabilities include file/process enumeration and manipulation, screenshot capture, keystroke logging, Chromium cookie extraction via a downloaded chromeelevator module, and a Chrome DevTools Protocol/WebDriver BiDi-based web-injection module that swaps form fields (e.g., IBAN substitution) on financial sites without traditional code injection. If primary WebSocket C2 domains are unreachable, TELEPUZ recovers a fallback address by decrypting content pulled from a Telegram channel (t.me/chanadarkpart, XOR key 'Goodman'), a Steam Community profile's name-history field, a DNS TXT-style lookup against codebasecode.com, or a Polygon blockchain smart contract (AES-256-CBC decryption), the last of which doubles as an operator-controlled kill switch. As of the July 2026 Elastic Security Labs disclosure the shellcode-injection command remained an unimplemented TODO, underscoring the malware's active, rapid development by what is assessed to be a small team or solo developer. This is the second ClickFix-delivered threat cluster Elastic has tracked in this timeframe, following SCMBANKER.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074 Data Staged; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion

Exfiltration

T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055 Process Injection; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1614 System Location Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1203 Exploitation for Client Execution; T1204 User Execution; T1569 System Services

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

defense-impairment

T1685 Disable or Modify Tools

Remediation for TELEPUZ RAT VIDAR second stage

Immediate actions

• Block all published TELEPUZ/VIDAR staging domains and IPs at DNS/proxy/perimeter firewall
• Alert on and quarantine any process spawning rundll32.exe with an unusual DLL path under %AppData%\Local or %ProgramData%
• Hunt for the Windows service names CipherAllocator and PilotmasterMast and the registry key HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator
• Search endpoint telemetry for the mutexes cfgmgr_mtx, bginfod_mtx, wfj64_mtx and registry marker Software\Microsoft\VisualStudio\Telemetry
• Block outbound connections to t.me/chanadarkpart, steamcommunity.com/profiles/76561199705801219, codebasecode[.]com, and JsonRPC calls to Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E from endpoint/server subnets where not business-justified
• Force-reset credentials and revoke browser session cookies for any host exhibiting TELEPUZ IOCs

Workarounds

• Disable clipboard-to-Run-dialog paste via Group Policy / registry where feasible
• Restrict rundll32.exe execution via Windows Defender Application Control (WDAC) or AppLocker to signed, known DLLs only

Longer-term hardening

• Deploy EDR with behavioral detection for AMSI/ETW patching, NTDLL unhooking, and indirect syscall trampolines
• Implement application allow-listing to prevent unsigned/unexpected DLLs from loading via rundll32.exe
• User awareness training specifically covering ClickFix/clipboard-hijacking lures (fake CAPTCHA, fake browser-update, 'paste this to verify you are human' prompts)
• Restrict or monitor Win+R Run dialog and PowerShell execution triggered immediately after clipboard paste events
• Monitor for anomalous outbound WebSocket connections to non-corporate domains using the /cdn/health?sid= URL pattern

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows Server (64-bit)

Timeline of TELEPUZ RAT VIDAR second stage

• 2026-04-27 Earliest observed locked-ioc-30 campaign activity, evidenced by initial Telegram fallback channel and Polygon smart-contract configuration.
• 2026-04-28 Fallback Telegram channel t.me/chanadarkpart created for encrypted C2 recovery.
• 2026-05-02 First locked-ioc-30 sample submitted to VirusTotal, beginning a pattern of daily build uploads.
• 2026-05-09 Staging/distribution domain locked-ioc-28 first observed hosting locked-ioc-30 payloads.
• 2026-05-14 Staging/distribution domain locked-ioc-20 becomes active in the campaign infrastructure rotation.
• 2026-05-19 Staging/distribution domain locked-ioc-21 begins distributing locked-ioc-30 components.
• 2026-05-27 Additional staging domains comicstar[.]lat and bigblower[.]click deployed as the operator rotates infrastructure.
• 2026-06-01 Sharp increase in campaign activity and observed binary-size growth begins in early June 2026.
• 2026-06-15 Further staging domains (locked-ioc-22, locked-ioc-15, locked-ioc-29, mazaporka, locked-ioc-27) activated between June 5-30 as part of continued infrastructure churn.
• 2026-06-24 Cloudflare-fronted IP locked-ioc-25 first observed hosting locked-ioc-30 staging infrastructure.
• 2026-07-06 Second Cloudflare-fronted IP locked-ioc-26 added to locked-ioc-30 staging infrastructure.
• 2026-07-16 Elastic Security Labs publishes technical analysis 'locked-ioc-30: a modular MaaS malware spreading via CLICKFIX-VIDAR chains', including 36-command list, C2 fallback chain, and IOCs.
• 2026-07-20 Shellcode-injection command remains an unimplemented TODO at time of disclosure, confirming the malware is still under active, rapid development.
• 2026-07-20 Cyber Security News and The Hacker News publish coverage summarizing the Elastic Security Labs findings.

Sources cited for TELEPUZ RAT VIDAR second stage

• TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains elastic.co · Research · 2026-07-20
• Elastic Security Labs — Malware Analysis elastic.co · Research · 2026-07-20
• Elastic protections-artifacts (Windows_Trojan_Telepuz.yar) GitHub · Code repository · 2026-07-20
• ClickFix Campaign Delivering TELEPUZ Malware cybersecuritynews.com · News · 2026-07-20
• New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands The Hacker News · News · 2026-07-20

Threats related to TELEPUZ RAT VIDAR second stage

• TELEPUZ: Modular MaaS Banking WebInjector Distributed via ClickFix/VIDAR Chain
• TELEPUZ Malware-as-a-Service Spreads via ClickFix Attacks and Go-Variant Vidar Stealer Chain
• TELEPUZ: New Modular Malware-as-a-Service Distributed via ClickFix Social Engineering
• ModHeader Chrome/Edge Extension (v7.0.17-7.0.18, 1.6M Installs) Contains Dormant AES-GCM Browsing-History Exfiltration Pipeline to api.stanfordstudies.com
• EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)

Previous and next in malware

• HollowGraph Malware Abuses Microsoft Graph API and M365 Calendar Events (Future-Dated 2050) for Stealthy Command-and-Control Next report