New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Cybersecurity researchers have recently identified a new modular malware known as TELEPUZ, which has been propagating through websites compromised with ClickFix lures since late April 2026. This malware is characterized by its lightweight and modular design, making it a significant threat for enterprises and security teams.

Technical Analysis

TELEPUZ is a sophisticated piece of malware that demonstrates advanced capabilities, including clipboard hijacking and obfuscation techniques. The malware is written in C and exhibits signs of being developed by a small team or possibly a single developer with a strong coding background. Its modular nature allows for easy updates and enhancements, which is evident from the regular submissions to VirusTotal.

The malware's primary functionality revolves around executing PowerShell commands that download a secondary payload from a remote server. This second-stage payload is a Go variant of the Vidar Stealer, notorious for harvesting sensitive data and deploying additional malicious components.

Affected Systems

TELEPUZ primarily targets Windows operating systems, leveraging PowerShell for execution. The malware's checks for system specifications, such as CPU count and memory, indicate a focus on avoiding detection in virtualized environments, which are commonly used in enterprise settings for testing and security monitoring.

Attack Method / Threat Activity

The ClickFix attack chain utilized by TELEPUZ involves social engineering tactics that trick users into executing malicious commands. This method, often referred to as pastejacking, injects harmful scripts into the user's clipboard, prompting them to paste and run these commands under the guise of fixing browser errors or software updates.

Once executed, TELEPUZ performs a series of checks to ensure it is not running in a sandbox or virtual environment. If these checks are passed, it proceeds to disable security features, including the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), thereby evading detection.

Detection Opportunities

Security teams can enhance their detection capabilities by focusing on the following areas:

• Monitor for unusual PowerShell activity, particularly commands that download external payloads.
• Implement rules in SIEM systems to flag clipboard access events that coincide with suspicious browser activity.
• Utilize threat intelligence feeds to stay updated on known C2 domains associated with TELEPUZ.
• Conduct regular threat hunting exercises to identify signs of clipboard hijacking and pastejacking techniques.

Mitigation Recommendations

To protect against TELEPUZ and similar threats, organizations should consider the following mitigation strategies:

• Educate employees about the risks of social engineering and the importance of verifying the legitimacy of software updates and browser fixes.
• Implement application whitelisting to restrict the execution of unauthorized software, particularly PowerShell scripts.
• Deploy endpoint protection solutions that can detect and block obfuscated malware and suspicious behavior.
• Regularly update and patch systems to close vulnerabilities that could be exploited by malware.

Business Impact

The emergence of TELEPUZ poses a significant risk to businesses, particularly those handling sensitive data. The capability of this malware to harvest information and deploy additional malicious payloads can lead to data breaches, financial loss, and reputational damage. Furthermore, the use of social engineering tactics increases the likelihood of successful attacks, making it imperative for organizations to bolster their security awareness and response strategies.

Final Summary

TELEPUZ represents a new wave of modular malware that leverages social engineering and advanced evasion techniques to compromise systems. Its ability to disable security measures and its focus on data exfiltration make it a serious threat to enterprises. By understanding the attack vectors and implementing robust detection and mitigation strategies, organizations can better protect themselves against this evolving threat landscape.