ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands

A new ClickFix campaign is tricking Windows users into running a malicious PowerShell command that installs TELEPUZ, a modular remote-access malware with 36 command handlers. The malware can steal browser cookies, record keystrokes, capture screenshots, execute commands and download additional payloads.

According to Elastic Security Labs’ TELEPUZ analysis, the operation has been active since around April 27 to April 29, 2026. The first identified sample reached VirusTotal on May 2, followed by frequent new builds and a significant increase in submissions from early June.

TELEPUZ uses a small initial payload and downloads specialized modules only when its operators need them. Elastic believes the volume of builds and pace of development may point to an emerging malware-as-a-service operation, although the researchers did not confirm that business model.

ClickFix tricks users into launching the infection

The attack begins on a malicious or compromised website displaying a fake verification, CAPTCHA or troubleshooting message. The page instructs the visitor to copy a command, open a Windows tool such as Run or PowerShell, paste the command and execute it.

Microsoft’s analysis of ClickFix social engineering explains that these attacks shift execution to the user. Instead of exploiting a browser vulnerability, the page convinces the victim to launch the malicious command through a trusted Windows interpreter.

MITRE ATT&CK classifies this behavior as Malicious Copy and Paste. The technique commonly uses fake errors or verification prompts to persuade users to run code in PowerShell, Command Prompt, Windows Terminal or the Run dialog.

Infection stage	Component	Purpose
Stage 1	ClickFix page	Convinces the user to paste and run a PowerShell command
Stage 2	VIDAR Go variant	Downloads the TELEPUZ stager and main payload
Stage 3	install.exe	Downloads, installs and launches the main DLL
Stage 4	telepuz.dll	Establishes persistence, contacts C2 and processes commands
Optional modules	Keylogger, stealer and web injector	Adds credential theft and browser manipulation capabilities

The PowerShell command downloads a VIDAR variant

In the infection observed by Elastic, the copied PowerShell command downloaded an executable from memshowblob[.]forum and saved it in the user’s temporary directory. It also attempted to remove the Zone.Identifier alternate data stream before executing the file.

The downloaded executable was a Go-based variant of VIDAR. It retrieved two more components from hurgadatour[.]shop: a small stager named install.exe and the main TELEPUZ library named telepuz.dll.

The stager measured roughly 13KB to 15KB. It installed the TELEPUZ DLL in a configured directory and executed it through rundll32.exe with a selected export name.

TELEPUZ contains 36 remote commands

After connecting to its command-and-control server, TELEPUZ can receive command names as readable text or hashes. Elastic counted 36 command handlers in the analyzed malware.

The commands cover file management, system discovery, privilege escalation, remote execution, credential theft and control over downloadable modules. Operators can also change the beacon interval, update the malware or terminate individual jobs.

One handler named InjectShellcode was not complete in the reference sample. It returned a placeholder message instead of injecting the supplied shellcode, providing further evidence that TELEPUZ remains under active development.

Capability	Example commands
System control	Execute commands, take screenshots, list processes and enumerate drives
File operations	List files, download files, upload data, delete files and create ZIP archives
Credential theft	Start a stealer, launch a keylogger and extract Chromium cookies
Privilege escalation	Elevate to administrator, elevate to SYSTEM and steal process tokens
Payload execution	Download PE files, run modules, hollow processes and migrate into a process
Malware management	Update TELEPUZ, stop modules, list jobs, kill jobs and change beacon timing

Modules add keylogging and browser credential theft

TELEPUZ keeps its main DLL relatively small by downloading extra components from the C2 server. Elastic identified separate keylogger, information-stealer, web-injector and Chromium cookie-extraction modules.

The keylogger can record user input, while the stealer can collect information from the compromised computer. A separate command downloads a utility designed to extract Chromium cookies protected by Chrome’s App-Bound Encryption.

Stolen browser cookies require a wider incident response than a password change alone. Valid session cookies can sometimes let an attacker continue accessing an account until the service revokes the session or the token expires.

The web injector can manipulate browser sessions

TELEPUZ includes a web-injector module that supports Chromium-based browsers and Firefox. Despite its name, the module does not always need to inject code directly into the browser process.

For Chromium browsers, it can use the Chrome DevTools Protocol to interact with open tabs. The Firefox implementation uses WebDriver BiDi. These browser-control interfaces allow the module to execute JavaScript, manage interception rules, retrieve cookies and modify page content.

Elastic found configuration fields that appeared designed to swap financial form values, including IBAN and payment amount fields. The analysis shows that the capability exists in the module, but it does not establish how often operators used it against real victims.

• Attach to browser tabs
• Execute JavaScript in selected pages
• Intercept browser requests and responses
• Retrieve session cookies
• Apply rules to matching websites
• Replace selected financial form fields

WebSockets carry commands and stolen data

TELEPUZ communicates with its C2 server through WebSockets using a simple JSON-based protocol. The malware can optionally protect the connection with TLS through Windows Secure Channel.

The implant first generates a victim identifier from the computer name, volume serial number and Windows installation date. It then connects to a WebSocket path containing that identifier and exchanges commands and results with the server.

Elastic identified only two core C2 domains in the analyzed infrastructure: cal.joycedoula[.]com[.]br and cal.snehamumbai[.]org. Both appeared to belong to legitimate websites that the operators had compromised.

Telegram, Steam, DNS and Polygon provide fallback servers

If TELEPUZ cannot reach its configured server after 10 attempts, it can look for a replacement address through four fallback methods. This design lets operators move the C2 channel without issuing a new malware build.

Fallback source	How TELEPUZ uses it
Telegram	Reads an encrypted C2 address from a specified channel profile
Steam	Extracts an encrypted server address from a profile name
DNS	Queries codebasecode[.]com for encrypted configuration data
Polygon blockchain	Calls a smart contract to retrieve an encrypted server address

Researchers did not find an active record associated with the observed DNS fallback domain. However, the Telegram, Steam and Polygon methods returned or referenced the secondary C2 domain.

The Polygon smart contract also acts as a kill switch. If the returned value contains fewer than 10 bytes, TELEPUZ exits its communication thread.

TELEPUZ checks for virtual machines and analysis tools

Before starting its main activity, TELEPUZ checks the computer’s processor count, memory, disk capacity, username, computer name and display device. These checks can help it avoid virtual machines, sandboxes and systems used by malware researchers.

The malware also checks the Windows locale against a hardcoded list covering Ukraine, Belarus, Armenia, Azerbaijan, Tajikistan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan and Moldova. It terminates if it identifies one of the excluded locales.

Other anti-analysis features include encrypted strings, dynamically resolved APIs, garbage instructions and indirect system calls. TELEPUZ also looks for software and hardware debugging indicators and attempts to interfere with attached debuggers.

Malware patches AMSI and ETW

TELEPUZ maps a clean copy of ntdll.dll and restores functions that security software may have hooked. It then patches Windows interfaces used for malware scanning and event collection.

The AMSI modification forces AmsiScanBuffer to return an invalid-argument error. TELEPUZ also patches ETW functions so they return success without recording the expected telemetry.

The malware searches registered DLL notification callbacks and removes entries that do not point to Windows libraries. This behavior can interfere with third-party monitoring components that rely on notifications when a process loads a DLL.

UAC bypass and token theft help establish persistence

TELEPUZ contains multiple methods for gaining elevated privileges. One uses the COM elevation moniker to start another copy with administrator rights. Researchers also found an alternative method involving AppInfo ALPC and Windows debugging objects.

After elevation, the malware can attempt to obtain SYSTEM privileges by stealing a token from a high-privilege process such as spoolsv.exe, msdtc.exe, WmiPrvSE.exe or svchost.exe.

TELEPUZ can then register itself as a Windows service and load inside a new svchost.exe process. One observed service name was CipherAllocator, while other samples used different service and file names to imitate legitimate software.

How organizations can detect TELEPUZ

Security teams should monitor chains in which a browser interaction quickly leads to PowerShell, rundll32.exe or another Windows interpreter. This sequence can reveal ClickFix activity even when the initial website and payload domains change.

The detection should account for copy-and-paste execution, downloads into temporary folders, removal of Zone.Identifier data and DLL execution from user-writable locations.

Elastic has also published a TELEPUZ YARA rule for scanning files and memory. Organizations should validate the rule in their environments before deploying it broadly.

• Alert when PowerShell downloads and immediately executes a file from a temporary directory.
• Monitor rundll32.exe loading DLLs from AppData or ProgramData subdirectories.
• Detect suspicious Windows service creation under unfamiliar names.
• Inspect unexpected outbound WebSocket connections from rundll32.exe or svchost.exe.
• Monitor attempts to patch AMSI, ETW or ntdll.dll.
• Look for browser debugging ports opened by an unexpected process.
• Block confirmed malicious domains and hashes at endpoint, DNS and network controls.

Selected TELEPUZ indicators of compromise

The complete Elastic research report contains the full collection of staging URLs, domains, hashes, file paths and registry artifacts. The most useful indicators include the following:

Type	Indicator	Description
Domain	memshowblob[.]forum	ClickFix second-stage delivery
Domain	hurgadatour[.]shop	TELEPUZ stager and payload hosting
Domain	cal.joycedoula[.]com[.]br	Early command-and-control domain
Domain	cal.snehamumbai[.]org	Fallback command-and-control domain
Domain	codebasecode[.]com	DNS fallback lookup
Telegram	t[.]me/chanadarkpart	Fallback C2 retrieval
File	install.exe	TELEPUZ stager
File	telepuz.dll	Main payload name
Mutex	cfgmgr_mtx	Prevents duplicate execution
Service	CipherAllocator	Observed persistence service
SHA-256	58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed	Reference TELEPUZ payload
SHA-256	a955d7e2819d5fa8b5f879cb970e1a1a91327098a7383f2a03a5e1e7e19435e3	Keylogger module
SHA-256	9733a3f6409de81271f21993c7f8b9865ac9f5c68c3d4336e91afe6b312477eb	Stealer module
SHA-256	444f1c0c82b3f6cc31d685bac68b20edbde5722ce219af9cceab0c2a6537efc1	Web-injector module

What to do after a suspected TELEPUZ infection

Organizations should isolate the affected computer immediately to stop C2 traffic and potential data theft. Investigators should preserve volatile evidence before removing services, processes or files.

Microsoft recommends teaching users that legitimate websites do not require visitors to paste commands into Windows tools. Its ClickFix defensive guidance also emphasizes behavioral detection because campaigns frequently change their pages, commands and download infrastructure.

After containment, responders should assume that TELEPUZ may have captured passwords, browser cookies and keystrokes. Passwords should be reset from a clean device, active sessions should be revoked and privileged credentials should be rotated.

Security teams can combine the published indicators with the Elastic YARA detection, endpoint telemetry and network records. Indicators alone may miss new builds, so defenders should prioritize the ClickFix execution chain and TELEPUZ’s behavior.

FAQ