TELEPUZ MaaS Malware Spreads Through ClickFix-to-VIDAR Infection Chains

Researchers reported that TELEPUZ is an emerging modular Windows malware family being distributed through ClickFix social-engineering lures that trick users into executing malicious commands, leading into VIDAR-based infection chains and staged payload delivery. The malware appears to be operated as malware-as-a-service (MaaS) and has shown rapid iteration, with lightweight loaders and DLL-based payloads designed to fetch additional components dynamically while maintaining a relatively small core command-and-control footprint.

Analysis shows TELEPUZ uses WebSocket communications with optional TLS and includes broad post-compromise capabilities such as defense evasion, anti-debugging, anti-VM checks, persistence, privilege escalation, token theft, keylogging, web injection, data theft, and Chromium cookie extraction. Researchers also found fallback C2 resolution through Telegram, Steam, DNS, and the Polygon blockchain, while core C2 infrastructure appears tied to compromised legitimate websites in Brazil and India; defenders were advised to hunt for related domains, IPs, hashes, file paths, network telemetry, and Windows registry service modifications to detect activity.