[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa5p6A2IWJYARB3h1rkG3R-AWJDgAylFVKTbn7zkS-Jk":3},{"article":4,"iocs":44,"watch_terms":58,"solutions":59,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"59bb7a6c-fb30-4587-91e7-9190d42b5c5b","New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands","new-telepuz-malware-spreads-via-clickfix-to-steal-data-and-run-commands-9a6678","Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. \"The malware is full-featured, lightweight, and modular,\" Elastic Security Labs researcher Cyril François said in a technical report. \"While the number of C2 [command-and-control] domains is currently small, the daily","Elastic Security Labs identified a new modular malware called TELEPUZ that has been actively spreading since late April 2026 through ClickFix social engineering attacks—a technique that tricks users into running malicious commands via clipboard hijacking. The malware, written in C and distributed via a Go variant of Vidar Stealer, is lightweight with extensive anti-analysis features including anti-VM checks, geolocation filtering, and defense evasion techniques. The steady volume of daily VirusTotal submissions and rapid development pace suggest TELEPUZ is likely offered as malware-as-a-service (MaaS).","TELEPUZ modular malware spreads via ClickFix social engineering since April 2026.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnew-telepuz-malware-spreads-via.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhv5Rn7Ccy_az1UqogtcMmy8m09NuHcnSuylWjVMecOfxDKbvUAt4FnqKIJp4uZUcOPUmnYGIywea1nJG-yiSqcQbPC-ULonG5US-gEbUnkEHbGN3cVnQdkqbxKGt0EY4We_j8V9RrH4NVgtbPFEfc5mdMxV9sTOWSx_p3ShB0LWleupJbo74xMVlGHistw\u002Fs1600\u002Fclick-malware.jpg","2026-07-16T12:50:13+00:00","2026-07-16T14:00:16.519735+00:00",9,[17,20,23],{"name":18,"type":19},"TELEPUZ threat actor (unnamed, likely solo developer or small team)","threat_actor",{"name":21,"type":22},"Elastic Security Labs","vendor",{"name":24,"type":25},"PowerShell","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,52,55],{"type":46,"value":47,"context":48},"domain","hurgadatour.shop","C2 and payload delivery domain for TELEPUZ stager and main DLL binary",{"type":30,"value":50,"context":51},"TELEPUZ","Modular malware written in C, distributed via ClickFix attacks",{"type":30,"value":53,"context":54},"Vidar Stealer","Go variant used as second-stage payload to harvest sensitive data and deploy TELEPUZ",{"type":30,"value":56,"context":57},"ClickFix","Social engineering attack technique using clipboard hijacking to distribute malware",[21],{"controls":60,"vendors":144},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":91,"name":92,"problem":93,"products":94},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":120,"name":121,"problem":122,"products":123},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[124,130,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":120,"product_name":134,"url":135,"description":136},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":141,"url":142,"description":143},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[145],{"slug":146,"name":147,"logo_path":148,"roles":149},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":170},"telepuz-malware-exploits-clickfix-social-engineering-to-steal-data","TELEPUZ Malware Exploits ClickFix Social Engineering to Steal Data","TELEPUZ malware spreads by tricking users into manually executing malicious commands through clipboard hijacking — a technique known as ClickFix — bypassing many traditional endpoint defenses because the user is the unwitting executor. The malware's modular, C-based design combined with anti-VM checks, geolocation filtering, and defense evasion makes it difficult to detect in automated analysis environments. Its distribution through a Go-based Vidar Stealer variant and likely Malware-as-a-Service (MaaS) model means it is accessible to a wide range of threat actors with low technical barriers. This attack chain highlights that even technically sophisticated malware often relies on human error as its primary entry point, making user awareness a critical — and frequently underinvested — control.",[156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 AC-6: Least Privilege","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1113: Screen Capture \u002F Clipboard Data (T1115)","GDPR Article 32: Security of Processing (data theft implications)",{}]