remote-access-implantphishing-campaign-intelligencecommand-and-control-methodcredential-stealer-activity

ClickFix Pages Infect Windows Users With TELEPUZ RAT

Malware Intelligence · 3 sources · Updated 3mo ago · First seen Jul 20, 2026

A ClickFix social-engineering campaign is tricking Windows users into copying and executing malicious commands from fake verification pages, leading to infection with the modular TELEPUZ remote-access trojan. Researchers said the intrusion chain uses a VIDAR-based second stage to retrieve a TELEPUZ loader and payload, after which the malware establishes command-and-control over WebSockets using a JSON-based protocol and exposes 36 remote commands to operators.

TELEPUZ is designed to begin as a lightweight foothold and then pull down additional modules for credential theft, keylogging, browser cookie extraction, web injection, and further payload delivery. The malware also uses anti-analysis techniques, UAC bypass, token theft, and Windows service persistence, while maintaining fallback methods for recovering C2 details through Telegram, a Steam profile, DNS records, and a Polygon smart contract; defenders were urged to train users not to paste commands from browser prompts, monitor PowerShell and rundll32.exe, isolate infected endpoints, and prioritize browser-session and credential remediation.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 20, 2026

Jul 20, 20263mo ago
Elastic discloses ClickFix campaign delivering TELEPUZ
Elastic reported a ClickFix social-engineering campaign delivering TELEPUZ via a VIDAR-based second stage that retrieves a loader and payload. The disclosure also detailed TELEPUZ's 36-command WebSocket-based RAT functionality, fallback C2 retrieval methods, and post-infection modules for credential theft and surveillance.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands
Jul 20, 20263mo ago
TELEPUZ campaign activity increases
Elastic reported that activity associated with the TELEPUZ campaign increased beginning in early June 2026. The campaign used fake verification pages to trick users into executing malicious commands that led to infection.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands
Jul 20, 20263mo ago
TELEPUZ malware activity begins
Elastic reported that the TELEPUZ remote-access malware had been active since late April 2026. The malware is described as a modular Windows RAT used in a ClickFix-style infection chain.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

TELEPUZ

Affected products

1 linked

Windows

Observables

60 linked

Domain••••••.comURLhttps://••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

IPv4 address•••.•••.••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain•••••••••••.ruURLhttps://•••••.•••/••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+52

Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

remote-access-implantphishing-campaign-intelligencecommand-and-control-methodcredential-stealer-activity

ClickFix Pages Infect Windows Users With TELEPUZ RAT

Malware Intelligence · 3 sources · Updated 3mo ago · First seen Jul 20, 2026

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 20, 2026

Jul 20, 20263mo ago
Elastic discloses ClickFix campaign delivering TELEPUZ
Elastic reported a ClickFix social-engineering campaign delivering TELEPUZ via a VIDAR-based second stage that retrieves a loader and payload. The disclosure also detailed TELEPUZ's 36-command WebSocket-based RAT functionality, fallback C2 retrieval methods, and post-infection modules for credential theft and surveillance.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands
Jul 20, 20263mo ago
TELEPUZ campaign activity increases
Elastic reported that activity associated with the TELEPUZ campaign increased beginning in early June 2026. The campaign used fake verification pages to trick users into executing malicious commands that led to infection.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands
Jul 20, 20263mo ago
TELEPUZ malware activity begins
Elastic reported that the TELEPUZ remote-access malware had been active since late April 2026. The malware is described as a modular Windows RAT used in a ClickFix-style infection chain.
ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

TELEPUZ

Affected products

1 linked

Windows

Observables

60 linked

Domain••••••.comURLhttps://••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+52

Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

ClickFix Pages Infect Windows Users With TELEPUZ RAT

How this story unfolded

Elastic discloses ClickFix campaign delivering TELEPUZ

TELEPUZ campaign activity increases

TELEPUZ malware activity begins

Related entities

Malware

Affected products

Observables

See the full picture, correlated to your attack surface.

Related stories

ClickFix Social Engineering Drives Multi-Platform Malware Delivery

ClickFix Campaign Uses HijackLoader to Deploy SectopRAT In Memory

ClickFix and Captive Portal Lures Drive RAT Delivery and Credential Theft

ClickFix Pages Infect Windows Users With TELEPUZ RAT

How this story unfolded

Elastic discloses ClickFix campaign delivering TELEPUZ

TELEPUZ campaign activity increases

TELEPUZ malware activity begins

Related entities

Malware

Affected products

Observables

See the full picture, correlated to your attack surface.

Related stories

ClickFix Social Engineering Drives Multi-Platform Malware Delivery

ClickFix Campaign Uses HijackLoader to Deploy SectopRAT In Memory

ClickFix and Captive Portal Lures Drive RAT Delivery and Credential Theft