# ClickFix Campaign Delivers TELEPUZ Modular RAT via VIDAR-Based Second Stage

> Elastic Security Labs is tracking TELEPUZ, a modular malware-as-a-service RAT with 36 remote commands spread since late April 2026 via ClickFix clipboard-hijacking lures that pull a Go-based VIDAR variant, which in turn installs a TELEPUZ stager (install.exe) and main payload (telepuz.dll) via rundll32.exe. The malware supports Chromium/Firefox cookie theft, keylogging, web-injection via browser debugging protocols, process hollowing, UAC bypass and token theft, and falls back to Telegram, Steam, DNS, and a Polygon blockchain smart contract to recover its C2 address if primary domains are seized.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1558
- **ID:** TL-2026-1558
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TELEPUZ is a lightweight, modular Windows RAT written in C, distributed under an apparent malware-as-a-service model evidenced by daily VirusTotal build submissions and steady binary-size growth since campaign onset. Victims are lured through fake browser/verification pages using the ClickFix social-engineering technique: a spoofed CAPTCHA or update prompt instructs the user to press Win+R and paste a clipboard-hijacked PowerShell command, which fetches a Go-based VIDAR variant from hurgadatour[.]shop. VIDAR downloads and executes two additional components: a small (~13-15KB) stager, install.exe, and the main 64-bit payload, telepuz.dll, launched via rundll32.exe. telepuz.dll establishes a WebSocket (optionally TLS-wrapped) connection to a primary C2 domain and communicates using a JSON-based protocol with a hashed 36-command set (XOR-based hashing, initial value 0x1505). Before beaconing, the malware performs extensive anti-analysis: hardware/resource checks (rejects <2 CPUs, <2GB RAM, low disk), CIS-country geofencing via LCID, sandbox/researcher username and computer-name blacklists, hypervisor display-device detection, NTDLL unhooking, AMSI/ETW patching, DLL notification-callback removal, and multi-layered debugger detection (including infinite-sleep on detection). Persistence is achieved by registering a Windows service (commonly named CipherAllocator, alternately PilotmasterMast) and dropping the DLL under disguised paths in %AppData% or %ProgramData%. Privilege escalation uses a COM elevation moniker, AppInfo ALPC abuse, and token theft from privileged system processes (spoolsv.exe, msdtc.exe, WmiPrvSE.exe, svchost.exe). Core capabilities include file/process enumeration and manipulation, screenshot capture, keystroke logging, Chromium cookie extraction via a downloaded chromeelevator module, and a Chrome DevTools Protocol/WebDriver BiDi-based web-injection module that swaps form fields (e.g., IBAN substitution) on financial sites without traditional code injection. If primary WebSocket C2 domains are unreachable, TELEPUZ recovers a fallback address by decrypting content pulled from a Telegram channel (t.me/chanadarkpart, XOR key 'Goodman'), a Steam Community profile's name-history field, a DNS TXT-style lookup against codebasecode.com, or a Polygon blockchain smart contract (AES-256-CBC decryption), the last of which doubles as an operator-controlled kill switch. As of the July 2026 Elastic Security Labs disclosure the shellcode-injection command remained an unimplemented TODO, underscoring the malware's active, rapid development by what is assessed to be a small team or solo developer. This is the second ClickFix-delivered threat cluster Elastic has tracked in this timeframe, following SCMBANKER.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1129 Shared Modules
- T1569 System Services
- T1203 Exploitation for Client Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1218 System Binary Proxy Execution
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1057 Process Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1113 Screen Capture
- T1185 Browser Session Hijacking
- T1115 Clipboard Data
- T1005 Data from Local System
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1029 Scheduled Transfer

## Sources

- [ClickFix Campaign Delivering TELEPUZ Malware](https://cybersecuritynews.com/clickfix-campaign-delivers-telepuz/)
- [TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains](https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix)
- [New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands](https://thehackernews.com/2026/07/new-telepuz-malware-spreads-via.html)
- [Elastic protections-artifacts (Windows_Trojan_Telepuz.yar)](https://github.com/elastic/protections-artifacts)
- [Elastic Security Labs — Malware Analysis](https://www.elastic.co/security-labs/topics/malware-analysis)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1558