--- title: TELEPUZ: a modular MaaS malware spreading via... description: Elastic Security Labs has published a deep technical analysis of TELEPUZ, a new modular Malware-as-a-Service (MaaS) active since late April 2026. The malware... canonical: https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs | daily.dev og:description: Elastic Security Labs has published a deep technical analysis of TELEPUZ, a new modular Malware-as-a-Service (MaaS) active since late April 2026. The malware... og:url: https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr og:image: https://api.daily.dev/og/posts/IK4GrFjrR.png og:image:alt: TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 18 min read · 0 upvotes · 0 comments ## Summary Elastic Security Labs has published a deep technical analysis of TELEPUZ, a new modular Malware-as-a-Service (MaaS) active since late April 2026. The malware spreads via a ClickFix social engineering attack that leads to a VIDAR Go infostealer, which then drops the TELEPUZ stager and main payload. TELEPUZ is a lightweight, C-written 64-bit Windows DLL featuring extensive anti-analysis techniques including indirect syscalls, NTDLL unhooking, AMSI/ETW patching, garbage instruction obfuscation, and RC4 string encryption. It communicates with its C2 over WebSockets with TLS, and uses multiple fallback C2 resolution methods including Telegram, Steam profiles, DNS records, and a Polygon blockchain smart contract. The malware supports 36 commands and downloads modular payloads for keylogging, credential stealing, web injection (via Chrome DevTools Protocol), and Chrome cookie extraction. IOCs, hashing algorithms, and MITRE ATT&CK mappings are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What social engineering technique is used to deliver the TELEPUZ malware? TELEPUZ is delivered through a ClickFix social engineering chain combined with a Go variant of the Vidar malware. Victims visit a malicious page and are prompted to copy and paste a PowerShell command that downloads and executes a second-stage Vidar binary, which then retrieves the TELEPUZ stager and main DLL payload from attacker-controlled domains. _Security teams tracking ClickFix-based intrusion chains can follow evolving analysis like this on daily.dev._ ### How does TELEPUZ malware find its command and control server if the primary C2 fails? TELEPUZ retries its primary C2 up to 10 times, then falls back to four alternate resolution methods: a Telegram channel post, a Steam profile name/history, a DNS record lookup, and a Polygon blockchain smart contract queried via JsonRPC eth_call. Fallback data is XOR or AES256-CBC encrypted, and the smart contract also functions as a kill switch if the returned data is under 10 bytes. _Analysts hunting resilient C2 fallback schemes can track writeups like this on daily.dev._ ### What capabilities does the TELEPUZ malware have for stealing browser data and financial information? TELEPUZ downloads a WebInjector module that uses the Chrome DevTools Protocol and Firefox's WebDriver BiDi to intercept webpages and swap form fields, defaulting to targeting IBAN and payment amount fields. It also has a dedicated ExtractChromeCookiesUsingDownloadedChromeElevator command that deploys a Chrome App-Bound Encryption decryption tool to steal cookies, alongside separate keylogger and stealer modules. _Teams defending against browser-targeting stealers can follow detailed breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [TAG-195 Upgrades MaaS Ecosystem with Modular Tools](https://daily.dev/posts/tag-195-upgrades-maas-ecosystem-with-modular-tools-2fyzvi7co) · Recorded Future Blog · 0 upvotes · 0 comments - [Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem](https://daily.dev/posts/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem-rseragq9f) · Check Point Research · 0 upvotes · 0 comments - [Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack](https://daily.dev/posts/potemkin-loader-rmmproject-the-anatomy-of-a-clickfix-attack-d1zg3odq4) · Huntress Blog · 0 upvotes · 0 comments - [The Prestige of Malware: Unmasking ClickFix, Destructor Hijacking, and the “Dictionary Symphony”](https://daily.dev/posts/the-prestige-of-malware-unmasking-clickfix-destructor-hijacking-and-the-dictionary-symphony--nwjxgqjb9) · InfoSec Write-ups · 0 upvotes · 0 comments - [Fake Google and Cloudflare verification pages spread multiple malware families](https://daily.dev/posts/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families-8s8xqrwfw) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs","url":"https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr"},"datePublished":"2026-07-15T18:15:23.090Z","dateModified":"2026-09-14T07:25:57.808Z","description":"Elastic Security Labs has published a deep technical analysis of TELEPUZ, a new modular Malware-as-a-Service (MaaS) active since late April 2026. The malware...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/040a8b341334199d7c85fbc7c58150a0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/040a8b341334199d7c85fbc7c58150a0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,reverse-engineering","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains — Elastic Security Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/telepuz-a-modular-maas-malware-spreading-via-clickfix-vidar-chains-elastic-security-labs-ik4grfjrr#faq","mainEntity":[{"@type":"Question","name":"What social engineering technique is used to deliver the TELEPUZ malware?","acceptedAnswer":{"@type":"Answer","text":"TELEPUZ is delivered through a ClickFix social engineering chain combined with a Go variant of the Vidar malware. Victims visit a malicious page and are prompted to copy and paste a PowerShell command that downloads and executes a second-stage Vidar binary, which then retrieves the TELEPUZ stager and main DLL payload from attacker-controlled domains. Security teams tracking ClickFix-based intrusion chains can follow evolving analysis like this on daily.dev."}},{"@type":"Question","name":"How does TELEPUZ malware find its command and control server if the primary C2 fails?","acceptedAnswer":{"@type":"Answer","text":"TELEPUZ retries its primary C2 up to 10 times, then falls back to four alternate resolution methods: a Telegram channel post, a Steam profile name/history, a DNS record lookup, and a Polygon blockchain smart contract queried via JsonRPC eth_call. Fallback data is XOR or AES256-CBC encrypted, and the smart contract also functions as a kill switch if the returned data is under 10 bytes. Analysts hunting resilient C2 fallback schemes can track writeups like this on daily.dev."}},{"@type":"Question","name":"What capabilities does the TELEPUZ malware have for stealing browser data and financial information?","acceptedAnswer":{"@type":"Answer","text":"TELEPUZ downloads a WebInjector module that uses the Chrome DevTools Protocol and Firefox's WebDriver BiDi to intercept webpages and swap form fields, defaulting to targeting IBAN and payment amount fields. It also has a dedicated ExtractChromeCookiesUsingDownloadedChromeElevator command that deploys a Chrome App-Bound Encryption decryption tool to steal cookies, alongside separate keylogger and stealer modules. Teams defending against browser-targeting stealers can follow detailed breakdowns like this on daily.dev."}}]} ```