A recent cybersecurity threat has emerged, leveraging ClickFix pages to deceive Windows users into executing harmful commands. This operation introduces TELEPUZ, a streamlined but robust malware designed to receive and execute a wide range of instructions from its controllers.
Modus Operandi of TELEPUZ Campaign
The infiltration begins with a counterfeit verification page, prompting users to run a command. This action initiates a VIDAR-based secondary stage, which subsequently downloads the TELEPUZ loader and main payload. This method mirrors previous ClickFix campaigns, transforming user actions into points of entry.
According to a report by Elastic, shared with Cyber Security News (CSN), TELEPUZ has been operational since late April 2026, with significant activity spikes observed by early June. This indicates rapid expansion and evolution of the operation.
Capabilities and Communication
TELEPUZ is designed to remain minimal initially, with the ability to add functions as needed. This modular approach allows operators to incorporate data theft, keystroke logging, and browser manipulation without burdening the initial payload with all features.
Utilizing WebSockets, TELEPUZ communicates with its command-and-control server, employing a JSON-based protocol for data exchange. If the primary server contact fails, it can switch to alternative infrastructures via Telegram, Steam profiles, DNS records, or a Polygon blockchain smart contract.
Defensive Measures and Evasion Techniques
Before executing its main tasks, TELEPUZ verifies its environment, checking for virtual machines, sandboxes, debuggers, or geolocation restrictions. It employs encrypted strings, dynamic API lookups, and indirect system calls to circumvent Windows security measures.
To maintain persistence, TELEPUZ can replicate itself from temporary directories, exploit rundll32.exe, bypass User Account Control, and register as a Windows service. Such tactics ensure the malware’s continued operation and complicate removal efforts.
Recommendations for Organizations
Organizations are advised to train their users against executing commands prompted by browsers and to monitor unusual PowerShell and rundll32.exe activities. Blocking known indicators and employing DNS and web filtering are also recommended to mitigate this threat.
In the event of a confirmed TELEPUZ infection, security teams should prioritize browser-session theft response. This includes resetting exposed passwords, revoking active sessions, and rotating privileged credentials while closely monitoring endpoint activities for suspicious module downloads and outbound WebSocket traffic.
