Loading story…
A ClickFix social-engineering campaign is tricking Windows users into copying and executing malicious commands from fake verification pages, leading to infection with the modular TELEPUZ remote-access trojan. Researchers said the intrusion chain uses a VIDAR-based second stage to retrieve a TELEPUZ loader and payload, after which the malware establishes command-and-control over WebSockets using a JSON-based protocol and exposes 36 remote commands to operators.
TELEPUZ is designed to begin as a lightweight foothold and then pull down additional modules for credential theft, keylogging, browser cookie extraction, web injection, and further payload delivery. The malware also uses anti-analysis techniques, UAC bypass, token theft, and Windows service persistence, while maintaining fallback methods for recovering C2 details through Telegram, a Steam profile, DNS records, and a Polygon smart contract; defenders were urged to train users not to paste commands from browser prompts, monitor PowerShell and rundll32.exe, isolate infected endpoints, and prioritize browser-session and credential remediation.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic reported a ClickFix social-engineering campaign delivering TELEPUZ via a VIDAR-based second stage that retrieves a loader and payload. The disclosure also detailed TELEPUZ's 36-command WebSocket-based RAT functionality, fallback C2 retrieval methods, and post-infection modules for credential theft and surveillance.
Elastic reported that activity associated with the TELEPUZ campaign increased beginning in early June 2026. The campaign used fake verification pages to trick users into executing malicious commands that led to infection.
Elastic reported that the TELEPUZ remote-access malware had been active since late April 2026. The malware is described as a modular Windows RAT used in a ClickFix-style infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the **ClickFix** technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as **Lumma Stealer**, **DarkGate**, **Latrodectus**, **ScreenConnect**, and **AMOS**. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A **SmartApeSG** campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from `deltaode[.]com`, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with `89.124.79[.]98` over TCP 443. Separately, Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a sub-cluster of Russia-linked **Midnight Blizzard**, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering **CornFlake** and **ChocoShell** for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Aug 24, 2026
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026