TELEPUZ Malware Spreads Through ClickFix and VIDAR Infection Chain
Summary
Elastic researchers describe TELEPUZ, a modular Windows malware delivered through ClickFix and VIDAR. The actively developed threat uses WebSocket command-and-control and downloadable modules; researchers say it may be malware-as-a-service.
Key points
- A ClickFix lure prompts users to execute a PowerShell command that downloads a VIDAR Go variant, which then delivers a TELEPUZ stager and DLL.
- TELEPUZ uses indirect syscalls, import hashing, encrypted strings and environmental checks; it also patches AMSI and ETW and removes monitoring callbacks.
- The malware attempts UAC bypass and SYSTEM token theft, then can establish persistence as a Windows service.
- Its WebSocket command-and-control has fallback discovery methods using Telegram, Steam profiles, DNS and a Polygon smart contract.
- Downloadable modules support keylogging, data theft and web injection. The injector uses browser debugging protocols to intercept pages and can target financial form fields.
- Elastic observed regular new builds and estimates activity began in late April 2026; its malware-as-a-service assessment remains tentative.
- The analyzed sample's shellcode injection command was not yet implemented, consistent with ongoing development.
Article Details
- Attack Vectors
- A ClickFix lure prompts users to execute a PowerShell command that downloads and runs a VIDAR Go variant.
- VIDAR downloads the TELEPUZ stager and main DLL. TELEPUZ can then download additional modules and execute payloads through process hollowing.
- TELEPUZ communicates with C2 over WebSockets and can discover fallback addresses through Telegram, Steam profiles, DNS, and a Polygon smart contract.
- Defensive Notes
- Elastic provides the Windows_Trojan_Telepuz.yar detection rule.
- The article identifies service-based persistence, including the service name CipherAllocator, and default module paths that may assist investigation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | cal[.]joycedoula[.]com[.]br | Apparently compromised website used as TELEPUZ C2 and present in early sample configurations. |
| HOSTNAME | cal[.]snehamumbai[.]org | Apparently compromised website used as TELEPUZ fallback C2. |
| SHA256 | 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746 | TELEPUZ third-stage stager sample. |
| SHA256 | 444f1c0c82b3f6cc31d685bac68b20edbde5722ce219af9cceab0c2a6537efc1 | TELEPUZ web injector module sample. |
| SHA256 | 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954 | VIDAR Go second-stage sample. |
| SHA256 | 58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed | Reference TELEPUZ main payload sample. |
| SHA256 | 9733a3f6409de81271f21993c7f8b9865ac9f5c68c3d4336e91afe6b312477eb | TELEPUZ stealer module sample. |
| SHA256 | a955d7e2819d5fa8b5f879cb970e1a1a91327098a7383f2a03a5e1e7e19435e3 | TELEPUZ keylogger module sample. |
| SHA256 | bf3b4e645a3c0c23f87c55971069014f7424ad14497371ee7567eff68ffaf343 | TELEPUZ main payload sample. |
| SHA256 | ff791fe1532a2dc3b3c188a71bfd0177f973ef228e4d1dda1db6d3c4b0d62b3e | TELEPUZ main payload sample. |
| URL | hxxp[:]//krabsburger[.]xyz/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//172[.]67[.]165[.]144/files/telemetriawork/telepuz.dll | Specific IP-based TELEPUZ payload download URL listed in the staging table. |
| URL | hxxps[:]//betalegenda[.]cfd/files/xK7mR9pL2nQw5tY8/kmwvogwx.dll | TELEPUZ stage download URL. |
| URL | hxxps[:]//bigblower[.]click/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//chubrik[.]sbs/files/xK7mR9pL2nQw5tY8/ygvfuyze.dll | TELEPUZ stage download URL. |
| URL | hxxps[:]//comicstar[.]lat/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//hardendedom[.]shop/files/lemetriawork/epuz.dll | TELEPUZ stage download URL. |
| URL | hxxps[:]//hardendom[.]shop/files/telemetry/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//hardeneddom[.]shop/files/telemetrywork/telepuz | TELEPUZ payload download URL. |
| URL | hxxps[:]//hardenedom[.]shop/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//hurgadatour[.]shop/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//mamsites[.]lol/files/telemetrywork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//mavpaprokla[.]lat/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//memshowblob[.]forum/api/index.php?a=grab | ClickFix download URL for the VIDAR Go second stage. |
| URL | hxxps[:]//momasites[.]com/files/telemetrywork/telepuz | TELEPUZ payload download URL. |
| URL | hxxps[:]//momasites[.]lol/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//neblokirovka[.]as/telemetry/network/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//netblokirovka[.]asia/files/telemetriawork/telepuz.dll | TELEPUZ payload download URL. |
| URL | hxxps[:]//steamcommunity[.]com//profiles/76561199705801219 | Steam profile used to publish encrypted TELEPUZ fallback C2 information. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationTELEPUZ uses garbage instructions, import hashing, and encrypted strings to hinder analysis.T1055.012 · Process HollowingThe DownloadRunPE command can hollow a new dllhost.exe process and run a downloaded executable.T1056.001 · KeyloggingTELEPUZ can download and start a keylogger module.T1059.001 · PowerShellThe ClickFix command uses PowerShell to download and execute the VIDAR Go stage.T1070.004 · File DeletionTELEPUZ can copy itself to a persistence directory and delete the original sample.T1071.001 · Web ProtocolsTELEPUZ uses WebSockets, optionally secured with TLS, for C2 communication.T1102 · Web ServiceTELEPUZ retrieves fallback C2 information from a Telegram channel and a Steam profile.T1105 · Ingress Tool TransferVIDAR retrieves the TELEPUZ stager and DLL, and TELEPUZ downloads additional modules.T1113 · Screen CaptureTELEPUZ has a Screenshot command.T1134.001 · Token Impersonation/TheftDepending on configuration, TELEPUZ steals a token from a SYSTEM process to gain SYSTEM privileges.T1497.001 · System ChecksTELEPUZ checks hardware resources, system names, and display-device indicators for sandbox or virtualized environments.T1543.003 · Windows ServiceTELEPUZ creates registry entries to load itself as a service in svchost.exe.T1548.002 · Bypass User Account ControlTELEPUZ bypasses UAC using an elevated COM object or an AppInfo and DebugObjects approach.T1562.001 · Disable or Modify ToolsTELEPUZ patches AMSI and ETW functions and removes third-party DLL notification callbacks to reduce monitoring.T1622 · Debugger EvasionTELEPUZ checks process debugging information, hardware breakpoints, and the PEB debugging flag.
Malware
TELEPUZElastic Security Labs is tracking TELEPUZ, a modular and actively developed threat spreading through a CLICKFIX-VIDAR chain with stage hosting on domains such as hurgadatour[.]shop and C2 infrastructure includingVidarSecurity Labs is tracking TELEPUZ, a modular and actively developed threat spreading through a CLICKFIX-VIDAR chain with stage hosting on domains such as hurgadatour[.]shop and C2 infrastructure including
Tools
Countries
BrazilWhile the staging domains are protected by Cloudflare, concealing their true hosting locations, the C2 servers have been identified as compromised websites located in Brazil and India, respectively.IndiaWhile the staging domains are protected by Cloudflare, concealing their true hosting locations, the C2 servers have been identified as compromised websites located in Brazil and India, respectively.