TELEPUZ CLICKFIX-VIDAR chain: PowerShell spawn -> outbound C2 -> TEMP/AppData payload execution

Tim P@timdetections

•updated Jul 21, 2026•4•0•14

Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.