← BACK TO FEED
malwareClickFixinfostealerC2 evasionMaaS

TELEPUZ: The Modular Malware Using Telegram, Steam, and a Blockchain to Phone Home

TELEPUZ is a newly discovered modular malware written in C that has been spreading since late April 2026 through ClickFix-style social engineering attacks, which trick users into pasting and executing malicious commands. Once installed, it employs extensive evasion techniques — including anti-VM checks, AMSI/ETW disabling, and obfuscation — before establishing contact with its command-and-control server via WebSockets to steal data, log keystrokes, capture screenshots, and execute commands. The malware uses multiple fallback methods to locate its C2 server, including Telegram, Steam, DNS queries, and a Polygon blockchain smart contract, and is believed to be an early-stage malware-as-a-service (MaaS) offering based on its high build volume and rapid development pace.

A newly identified piece of malware called TELEPUZ has been quietly spreading since late April 2026, piggybacking on ClickFix-infected websites to get itself onto victim machines. Researchers at Elastic Security Labs broke it down this week, and it's a fairly polished bit of kit for something that appears to still be in early distribution.

ClickFix, for the uninitiated, is a social engineering technique that tricks users into running malicious commands themselves. Infected pages inject a payload into the clipboard and present fake browser errors, CAPTCHA prompts, or software update notices, telling the user to paste and run what's already been silently placed there. It's cynically simple and, unfortunately, it works.

In TELEPUZ's case, that clipboard payload kicks off a PowerShell command that pulls down a second-stage binary. That binary is a Go-based variant of the Vidar Stealer, which harvests credentials and sensitive data before dropping a stager that loads the main TELEPUZ DLL via rundll32.exe. Both components are pulled from a domain called hurgadatour[.]shop.

The malware itself is written in C. It's compact, modular, and according to Elastic researcher Cyril François, shows signs of being the work of a solo developer or very small team who actually knows what they're doing. The steady daily stream of new builds appearing on VirusTotal points toward a malware-as-a-service operation, albeit one that's still finding its feet.

Before doing anything useful, TELEPUZ runs through a fairly thorough evasion checklist. It looks for signs of virtualisation, checking CPU count, available RAM, and disk space. It queries the system locale to bail out if the machine appears to be in a CIS country, a standard move that strongly suggests the operators are based in that region. It cross-references usernames and machine names against known sandbox identifiers. If anything looks wrong, it shuts itself down.

Assuming it passes those checks, the malware goes to work on the security stack. It unhooks NTDLL, disables AMSI and ETW, and strips out third-party DLL notification callbacks, all standard techniques for getting out from under endpoint monitoring tools. It then checks for attached debuggers and attempts to crash them.

Once settled in, TELEPUZ tries to escalate privileges using the COM elevation moniker technique to reach admin level, then token theft from system processes like spoolsv.exe or WmiPrvSE.exe to reach SYSTEM. It then registers itself as a Windows service via registry keys, ensuring it loads inside a new svchost.exe instance on restart.

The C2 communication runs over WebSockets with optional TLS. But here's the part that's genuinely interesting: if the primary C2 connection fails after ten attempts, TELEPUZ has four separate fallback methods to retrieve a replacement address. It can pull an encrypted URL from a Telegram channel description (created April 28, 2026), grab the same address from a Steam Community profile, resolve it via a DNS query to codebasecode[.]com, or read it from a Polygon blockchain smart contract.

Using public platforms and decentralised infrastructure as dead-drop locations for C2 addresses is not new, but combining four separate methods in one piece of malware is thorough. Taking down any one of them won't kill the botnet.

The feature set once connected is broad: file operations, keylogging, screenshot capture, process management, command execution, cookie theft from Chromium browsers, and web injection. The browser module communicates directly with the C2 server and uses Chrome DevTools Protocol and WebDriver BiDi to siphon cookies and inject arbitrary JavaScript into both Chrome-based browsers and Firefox.

Elastic notes that the C2 infrastructure currently consists of compromised websites hosted in Brazil and India, with staging domains hidden behind Cloudflare. The relatively small number of C2 servers does suggest this operation is still early stage, despite the high build volume. Whether that changes quickly is worth watching.

READ NEXT
ACR Stealer Is Raiding Enterprise Networks and All It Needs Is for Someone to Press EnterReaper Malware Hits macOS: Steals Passwords, Drains Crypto Wallets, Then Quietly Moves InPamStealer: The macOS Malware That Actually Did Its Homework