New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
TELEPUZ modular malware spreads via ClickFix social engineering since April 2026.
Elastic Security Labs identified a new modular malware called TELEPUZ that has been actively spreading since late April 2026 through ClickFix social engineering attacks—a technique that tricks users into running malicious commands via clipboard hijacking. The malware, written in C and distributed via a Go variant of Vidar Stealer, is lightweight with extensive anti-analysis features including anti-VM checks, geolocation filtering, and defense evasion techniques. The steady volume of daily VirusTotal submissions and rapid development pace suggest TELEPUZ is likely offered as malware-as-a-service (MaaS).
AI summary of the linked source. Not reviewed by an editor. How this works
Run Elastic Security Labs?
Get an email when a new story names Elastic Security Labs, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTELEPUZ malware spreads by tricking users into manually executing malicious commands through clipboard hijacking — a technique known as ClickFix — bypassing many traditional endpoint defenses because the user is the unwitting executor. The malware's modular, C-based design combined with anti-VM checks, geolocation filtering, and defense evasion makes it difficult to detect in automated analysis environments. Its distribution through a Go-based Vidar Stealer variant and likely Malware-as-a-Service (MaaS) model means it is accessible to a wide range of threat actors with low technical barriers. This attack chain highlights that even technically sophisticated malware often relies on human error as its primary entry point, making user awareness a critical — and frequently underinvested — control.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — hurgadatour.shop
- malware — TELEPUZ
- malware — Vidar Stealer
- malware — ClickFix