Loading malware…
TELEPUZ is a modular remote-access trojan for 64-bit Windows systems, active since late April 2026. Written in C, it combines a lightweight DLL-based core with downloadable modules for credential theft, keylogging, browser-cookie extraction, and web injection. Observed infections begin on compromised websites displaying ClickFix verification lures that persuade users to execute malicious PowerShell commands. These commands launch a Go-based VIDAR stage, which retrieves the TELEPUZ stager and main payload. No specific threat actor attribution has been confirmed.
TELEPUZ supports 36 operator commands covering shell-command execution, file transfers, filesystem and process enumeration, screenshots, process management, privilege escalation, module loading, and self-updating. It can execute downloaded payloads through process hollowing. Its browser modules extract Chromium cookies and interact with Chromium-based browsers and Firefox through Chrome DevTools Protocol and WebDriver BiDi. The web-injection component can intercept financial browsing activity and replace payment fields, including IBAN values.
The malware establishes persistence as a Windows service, bypasses User Account Control, and can steal privileged process tokens to obtain SYSTEM access. Defense-evasion features include encrypted strings, hashed API resolution, indirect system calls, native API unhooking, AMSI and ETW patching, and removal of third-party DLL notification callbacks. It checks for virtual machines, sandboxes, and debuggers, and avoids systems configured with selected regional locales.
Command-and-control communication uses a JSON-based protocol over WebSockets, with optional TLS through Windows SChannel. If its primary server becomes unavailable, TELEPUZ retrieves replacement infrastructure information through Telegram, Steam profiles, DNS, or a Polygon blockchain smart contract. The blockchain mechanism also supports a kill switch. TELEPUZ remains under active development.
62 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection chain begins with a ClickFix social engineering infection, in which the user visits a malicious web page and is prompted to copy and paste, then execute, a Windows shell command to access the page's content.
From there, operators can pick from 36 commands. Those cover screenshots, file upload, process listing, and shellcode injection.
The ClickFix command invokes WindowsPowerShell with -NoP, hidden window, execution-policy bypass, and a WebClient download-and-execute sequence.
The commands make it possible to siphon cookies and run arbitrary JavaScript on the browsers by taking advantage of the Chrome DevTools Protocol (CDP) and WebDriver BiDi protocol.
TELEPUZ maps a fresh copy of ntdll.dll, extracts syscall numbers, and generates indirect-syscall trampoline stubs.
The main payload is a 64-bit Windows shared library with exports such as GatewayLaunch and ServiceRoutine.
A victim lands on a malicious page and sees a prompt to copy and paste a Windows shell command. Running that command fetches the second stage into the temporary folder.
The infection chain begins with a ClickFix social engineering infection, in which the user is prompted to copy, paste, and execute a Windows shell command.
The malware installs itself as a service and configures Windows to load it in a new svchost.exe instance.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe...
The malware creates the necessary registry keys for the CipherAllocator service, including ServiceDll and ServiceMain parameters.
It registers itself as a service by creating registry keys to instruct Windows to load the malware within a new svchost.exe instance.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe... and register a Windows service.
...and run executable files inside hollowed processes...
DownloadRunPE downloads a PE executable, creates a dllhost.exe process, and performs process hollowing with the downloaded PE.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe, bypass User Account Control, steal higher-privileged access tokens...
Depending on configuration TELEPUZ tries to get SYSTEM privilege by stealing the token of spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe.
The malware can elevate itself and includes commands named ElevateToAdmin, ElevateToSystem, StealProcessToken, and RevertToken.
It registers itself as a service by creating registry keys to instruct Windows to load the malware within a new svchost.exe instance.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe... and register a Windows service.
...bypass User Account Control, steal higher-privileged access tokens...
The installation thread elevates using the COM elevation moniker technique; an alternative bypass uses AppInfo ALPC and DebugObjects.
It also uses encrypted strings, dynamic API lookups, indirect system calls...
Should the checks pass, the malware unhooks NTDLL, patches AMSI and ETW, and strips third-party DLL notification callbacks.
TELEPUZ employs module and import name hashing to resolve its imports, which are dynamically loaded upon each invocation.
TELEPUZ decrypts strings using a custom RC4 implementation, using constants that vary between samples.
the observed chain begins with a ClickFix page that asks the user to run a hidden PowerShell command
Exports are selected to disguise the library as legitimate software, and the service is named CipherAllocator.
...and run executable files inside hollowed processes...
DownloadRunPE downloads a PE executable, creates a dllhost.exe process, and performs process hollowing with the downloaded PE.
They include options to run commands, list files and processes, take screenshots, upload data, create ZIP archives, delete files...
If executed from %TEMP%, TELEPUZ copies itself to its persistence directory, re-runs itself, and deletes the current sample.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe, bypass User Account Control, steal higher-privileged access tokens...
Depending on configuration TELEPUZ tries to get SYSTEM privilege by stealing the token of spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe.
The malware can elevate itself and includes commands named ElevateToAdmin, ElevateToSystem, StealProcessToken, and RevertToken.
After downloading the DLL, the stager installs it and executes it using rundll32 with the specified export name.
Before beginning normal activity, TELEPUZ checks whether it is running in a virtual machine, sandbox, debugger, or an excluded geographic region.
The malware checks CPU count, memory, disk space, locale, usernames, computer names, and display-device hypervisor identifiers.
If a debugger is identified, the malware calls the Sleep function with an INFINITE parameter.
For persistence, the malware can copy itself from temporary folders, relaunch through rundll32.exe...
DownloadLoadMalwareModule loads a malware-compatible DLL with known exports.
It inspects ProcessDebugPort, ProcessDebugFlags, ProcessDebugObjectHandle, hardware breakpoints, PEB.BeingDebugged, and uses ThreadHideFromDebugger.
The malware creates the necessary registry keys for the CipherAllocator service, including ServiceDll and ServiceMain parameters.
TELEPUZ performs NTDLL unhooking, AMSI and ETW patching, and removal of DllNotification callbacks to disable security monitoring.
Several commands are built for credential theft and follow-on intrusion. TELEPUZ can retrieve a stealer module, start a keylogger...
TELEPUZ can download and start a keylogger module and has commands to retrieve or control keylogger status.
TELEPUZ uses the C2 server to establish communication... allowing it to perform a wide range of malicious actions, including... web injection...
TELEPUZ downloads a Chrome App-Bound Encryption decryption tool through ExtractChromeCookiesUsingDownloadedChromeElevator.
The malware downloads stealer modules and includes browser cookie extraction functionality for Chromium-based browsers.
The malware compares the current username against sandbox identifiers, and its beacon contains the username.
Commands include ListRunningProcesses, and SYSTEM token theft selects from named running processes.
The generated session identifier combines the hardware serial number, computer name, and OS installation date; beacon data includes OS version and architecture.
The malware supports Ls and GetPathsInfo commands, with the latter returning running, install, and stager paths.
Before beginning normal activity, TELEPUZ checks whether it is running in a virtual machine, sandbox, debugger, or an excluded geographic region.
The malware checks CPU count, memory, disk space, locale, usernames, computer names, and display-device hypervisor identifiers.
If a debugger is identified, the malware calls the Sleep function with an INFINITE parameter.
The module operates on Chromium-based browsers and Firefox.
TELEPUZ ensures the system LCID is not among a hardcoded list of CIS-country locales.
It inspects ProcessDebugPort, ProcessDebugFlags, ProcessDebugObjectHandle, hardware breakpoints, PEB.BeingDebugged, and uses ThreadHideFromDebugger.
Several commands are built for credential theft and follow-on intrusion. TELEPUZ can retrieve a stealer module, start a keylogger...
TELEPUZ can download and start a keylogger module and has commands to retrieve or control keylogger status.
TELEPUZ uses the C2 server to establish communication... allowing it to perform a wide range of malicious actions, including... web injection...
The command table includes Screenshot.
Underpinning the technique is an approach called clipboard hijacking. Because web pages using ClickFix inject malicious script or commands into a potential victim's clipboard and provide instructions to paste and run them, it's also referred to as pastejacking.
The WebInjector module uses CDP and Firefox WebDriver BiDi to intercept web pages, execute JavaScript, and swap financial form fields such as IBAN values.
They include options to run commands, list files and processes, take screenshots, upload data, create ZIP archives, delete files...
The malware currently has 36 commands, they are described in the table below: ... CreateZip
The command table includes CreateZip.
It can repeatedly try its main server, then seek replacement infrastructure through Telegram, a Steam profile, DNS records, or a Polygon blockchain smart contract if contact fails.
Once connected, TELEPUZ speaks a simple JSON protocol over WebSockets. It beacons hostname, username, OS version, and architecture.
Once C2 is resolved, TELEPUZ establishes WebSocket communication using /cdn/health?sid= and JSON-based messages.
The C2 server can be reached through various fallback methods, including encrypted URLs from Telegram, Steam profiles, DNS queries, and Polygon blockchain smart contracts.
Fallback C2 URLs are retrieved using a Telegram profile, Steam profile, DNS records, or a Polygon blockchain smart contract.
VIDAR downloads and executes the TELEPUZ stager and main binary; TELEPUZ can also download PE files, DLL modules, and functional modules from C2.
The campaign delivers TELEPUZ, a lightweight but capable remote-access malware that can receive dozens of instructions from its operators.
On failure, it reaches for four fallback methods. Those include a Telegram profile, a Steam profile name, a DNS record, and a smart contract on the Polygon blockchain. Each holds an encrypted address that operators can rotate at will.
If TLS is enabled, TELEPUZ uses Windows SChannel and InitializeSecurityContextA to establish a TLS tunnel to C2.
The C2 thread handles command reception, execution, and data exfiltration over the established WebSocket connection.
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.