New TELEPUZ Malware Spreads via Click Fix to Steal Data and Run Commands
Summary: Elastic Security Labs researchers documented a new modular malware called TELEPUZ that has spread since late April 2026 through websites infected with ClickFix lures, which trick users into pasting and running malicious commands from their clipboard. The ClickFix chain runs PowerShell that downloads a Go variant of Vidar Stealer, which then launches a stager that loads telepuz.dll via rundll32.exe, with both binaries retrieved from the domain hurgadatour[.]shop.
Why it matters: TELEPUZ disables AMSI, ETW and NTDLL unhooking once its checks pass, then steals tokens from processes like spoolsv.exe and svchost.exe to reach SYSTEM and install itself as a service - and its C2 servers were found on compromised websites in Brazil and India, meaning the infrastructure behind it is other people's legitimate sites.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026