Loading story…
Researchers reported that TELEPUZ is an emerging modular Windows malware family being distributed through ClickFix social-engineering lures that trick users into executing malicious commands, leading into VIDAR-based infection chains and staged payload delivery. The malware appears to be operated as malware-as-a-service (MaaS) and has shown rapid iteration, with lightweight loaders and DLL-based payloads designed to fetch additional components dynamically while maintaining a relatively small core command-and-control footprint.
Analysis shows TELEPUZ uses WebSocket communications with optional TLS and includes broad post-compromise capabilities such as defense evasion, anti-debugging, anti-VM checks, persistence, privilege escalation, token theft, keylogging, web injection, data theft, and Chromium cookie extraction. Researchers also found fallback C2 resolution through Telegram, Steam, DNS, and the Polygon blockchain, while core C2 infrastructure appears tied to compromised legitimate websites in Brazil and India; defenders were advised to hunt for related domains, IPs, hashes, file paths, network telemetry, and Windows registry service modifications to detect activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-16, Gurucul published analysis of TELEPUZ as a modular MaaS framework delivered through ClickFix social engineering, highlighting its multi-stage infection chain, obfuscated loaders, dynamic payload delivery, and anti-analysis techniques. The report added practical detection opportunities and indicators including domains, IPs, hashes, file paths, registry artifacts, and detection queries based on telemetry and service modifications.
On 2026-05-09, Elastic Security Labs published a report describing TELEPUZ as an emerging modular malware family with WebSocket-based C2, anti-analysis features, persistence, privilege escalation, token theft, and downloadable modules for data theft and web injection. The report also noted fallback C2 resolution via Telegram, Steam, DNS, and the Polygon blockchain, and assessed the main C2 domains as likely compromised legitimate sites in Brazil and India.
Elastic Security Labs said the TELEPUZ malware family appears to have been active since late April 2026, spreading through a ClickFix-to-VIDAR infection chain. The activity involved a modular Windows malware framework likely operated as malware-as-a-service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourcecommunity.gurucul.com
Open sourceelastic.co
Open sourceunit42.paloaltonetworks.com
Open sourcecloud.google.com
Open sourcegroup-ib.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 15, 2026
BlueVoyant and other researchers reported that the **Lorem Ipsum** malware operation abandoned Trojanized Microsoft Teams installers signed with fraudulent Microsoft Trusted Signing certificates and moved to **ClickFix** lures hosted on compromised WordPress sites. The change followed Microsoft’s disruption of the Fox Tempest malware-signing-as-a-service ecosystem and revocation of more than 1,000 fraudulently obtained certificates, which undercut the group’s earlier delivery method. BlueVoyant assessed with high confidence that the activity is tied to **Rapid Brigantine**—also tracked as **Vanilla Tempest**, `DEV-0832`, and **Vice Society**—a financially motivated actor linked to ransomware and data extortion. The updated infection chain uses fake browser updates or CAPTCHA-style prompts to socially engineer victims into running malicious commands, expanding targeting beyond users searching for fake Teams downloads. Researchers said the malware relies on a multistage loader, DLL sideloading, encrypted payloads, and dead-drop command-and-control through `LetsDiskuss[.]com`, while parallel ClickFix campaigns have also delivered loaders such as **BabaDeda**, **Potemkin**, and **GULoader** using in-memory execution and remote DLL loading via `rundll32.exe`. The reporting underscores ClickFix as a durable initial-access technique on compromised websites that can lead to stealers, RATs, remote management tools, and hands-on-keyboard post-compromise activity.
Jul 12, 2026