TELEPUZ: The Modular Malware Using Telegram, Steam, and a Blockchain to Phone Home
A newly identified piece of malware called TELEPUZ has been quietly spreading since late April 2026, piggybacking on ClickFix-infected websites to get itself onto victim machines. Researchers at Elastic Security Labs broke it down this week, and it's a fairly polished bit of kit for something that appears to still be in early distribution.
ClickFix, for the uninitiated, is a social engineering technique that tricks users into running malicious commands themselves. Infected pages inject a payload into the clipboard and present fake browser errors, CAPTCHA prompts, or software update notices, telling the user to paste and run what's already been silently placed there. It's cynically simple and, unfortunately, it works.
In TELEPUZ's case, that clipboard payload kicks off a PowerShell command that pulls down a second-stage binary. That binary is a Go-based variant of the Vidar Stealer, which harvests credentials and sensitive data before dropping a stager that loads the main TELEPUZ DLL via rundll32.exe. Both components are pulled from a domain called hurgadatour[.]shop.
The malware itself is written in C. It's compact, modular, and according to Elastic researcher Cyril François, shows signs of being the work of a solo developer or very small team who actually knows what they're doing. The steady daily stream of new builds appearing on VirusTotal points toward a malware-as-a-service operation, albeit one that's still finding its feet.
Before doing anything useful, TELEPUZ runs through a fairly thorough evasion checklist. It looks for signs of virtualisation, checking CPU count, available RAM, and disk space. It queries the system locale to bail out if the machine appears to be in a CIS country, a standard move that strongly suggests the operators are based in that region. It cross-references usernames and machine names against known sandbox identifiers. If anything looks wrong, it shuts itself down.
Assuming it passes those checks, the malware goes to work on the security stack. It unhooks NTDLL, disables AMSI and ETW, and strips out third-party DLL notification callbacks, all standard techniques for getting out from under endpoint monitoring tools. It then checks for attached debuggers and attempts to crash them.
Once settled in, TELEPUZ tries to escalate privileges using the COM elevation moniker technique to reach admin level, then token theft from system processes like spoolsv.exe or WmiPrvSE.exe to reach SYSTEM. It then registers itself as a Windows service via registry keys, ensuring it loads inside a new svchost.exe instance on restart.
The C2 communication runs over WebSockets with optional TLS. But here's the part that's genuinely interesting: if the primary C2 connection fails after ten attempts, TELEPUZ has four separate fallback methods to retrieve a replacement address. It can pull an encrypted URL from a Telegram channel description (created April 28, 2026), grab the same address from a Steam Community profile, resolve it via a DNS query to codebasecode[.]com, or read it from a Polygon blockchain smart contract.
Using public platforms and decentralised infrastructure as dead-drop locations for C2 addresses is not new, but combining four separate methods in one piece of malware is thorough. Taking down any one of them won't kill the botnet.
The feature set once connected is broad: file operations, keylogging, screenshot capture, process management, command execution, cookie theft from Chromium browsers, and web injection. The browser module communicates directly with the C2 server and uses Chrome DevTools Protocol and WebDriver BiDi to siphon cookies and inject arbitrary JavaScript into both Chrome-based browsers and Firefox.
Elastic notes that the C2 infrastructure currently consists of compromised websites hosted in Brazil and India, with staging domains hidden behind Cloudflare. The relatively small number of C2 servers does suggest this operation is still early stage, despite the high build volume. Whether that changes quickly is worth watching.