TELEPUZ Modular MaaS Malware Distributed via CLICKFIX-VIDAR

Elastic Security Labs has identified a new modular Malware-as-a-Service (MaaS) named TELEPUZ, active since late April 2026. The malware is primarily distributed via the CLICKFIX-VIDAR infection chain, which uses social engineering to trick users into executing PowerShell commands. TELEPUZ is highly modular, frequently updated, and designed for data exfiltration and secondary payload delivery.

Technically, TELEPUZ is notable for its sophisticated evasion and persistence mechanisms. It utilizes indirect syscalls by patching standard Windows libraries, implements aggressive anti-sandbox and anti-debugging checks, and bypasses UAC via COM elevation monikers. Its C2 infrastructure is resilient, utilizing dead-drop resolvers on Telegram, Steam profiles, and the Polygon blockchain to update its command-and-control endpoints if the primary server fails.

The rapid evolution of TELEPUZ suggests it is an emerging threat in the MaaS landscape. Its ability to intercept browser traffic via the Chrome DevTools Protocol and WebDriver BiDi for financial theft (e.g., IBAN swapping) poses a significant risk to individuals and organizations, particularly in sectors where financial transactions are frequent.