# New TELEPUZ Malware Spreads via ClickFix Lures, Delivers Modular Payload for Data Theft and Remote Command Execution


Cybersecurity researchers at Elastic Security Labs have uncovered a sophisticated new malware strain called TELEPUZ that has been actively spreading through compromised websites using ClickFix social engineering lures since late April 2026. The lightweight, modular malware is capable of stealing sensitive data and executing arbitrary commands on infected systems—presenting a significant threat to organizations across multiple sectors.


## The Threat


TELEPUZ represents a particularly concerning variant of the evolving malware landscape due to its modular architecture and full-featured functionality. According to Elastic Security Labs researcher Cyril François, the malware's design allows threat actors to customize payloads for specific targets and objectives, deploying only the components needed for each attack.


Unlike monolithic malware that carries all functionality in a single executable, TELEPUZ's modular design offers attackers several advantages:


  • Reduced detection footprint – Smaller initial payloads are less likely to trigger security filters
  • Flexibility – Components can be swapped or added based on campaign objectives
  • Evasion capabilities – Modular updates can circumvent signature-based detection
  • Command-and-control efficiency – Lightweight C2 communication reduces network detection

    • The malware has been observed in active campaigns with command-and-control infrastructure currently limited in scope, though researchers warn that the threat landscape may expand rapidly.


    ## How TELEPUZ Spreads: The ClickFix Vector


    ClickFix has emerged as a significant social engineering technique in 2026, and TELEPUZ operators have weaponized it effectively. ClickFix lures typically display fake security warnings on compromised websites, prompting users to click on URLs that appear to lead to solutions but actually initiate malware downloads.


    ### The Attack Flow


    1. Victim visits compromised website – The site has been injected with ClickFix code

    2. Fake warning appears – User sees alarming messages about malware, security threats, or system issues

    3. User clicks "Fix" or "Scan Now" – The link redirects to attacker-controlled infrastructure

    4. TELEPUZ payload downloads – Initial dropper begins execution

    5. Modular components load – Secondary payloads deliver data-stealing and command-execution capabilities


    This technique is particularly effective because it exploits legitimate user concern about security rather than relying purely on technical exploits. Users actively choose to execute the malware, making initial detection significantly harder for endpoint security tools.


    ## Technical Details: Architecture and Capabilities


    Elastic Security Labs' analysis reveals that TELEPUZ employs a sophisticated multi-stage architecture designed for resilience and flexibility:


    | Component | Function | Details |

    |-----------|----------|---------|

    | Initial Dropper | Deployment & Execution | Lightweight payload that downloads secondary components |

    | Loader Module | Persistence & Staging | Establishes communication with C2 infrastructure |

    | Infostealer Component | Data Exfiltration | Harvests credentials, browser data, file system information |

    | Command Executor | Remote Access | Executes arbitrary commands from C2 servers |

    | Persistence Mechanism | Survival | Ensures malware survives system reboots |


    The malware communicates with command-and-control servers using obfuscated protocols designed to evade network detection. Current infrastructure analysis shows a relatively limited number of active C2 domains, though researchers caution that this may be a temporary constraint.


    TELEPUZ demonstrates several evasion techniques:


  • Process injection – Code execution within legitimate Windows processes
  • Registry persistence – Modifications to Windows registry for survivability
  • Anti-analysis methods – Detection of sandbox and debugging environments
  • Code obfuscation – Encrypted strings and dynamic function resolution

    • ## Who Is at Risk?


    TELEPUZ targets users across multiple vectors, though certain groups face elevated exposure:


  • High-traffic website visitors – The malware spreads via compromised websites, making users of popular platforms at risk
  • Organizations with minimal security training – ClickFix exploits social engineering vulnerabilities
  • Systems without updated endpoint protection – Outdated security software may not detect modular payloads
  • Users of shared or public computers – Increased likelihood of visiting compromised sites

    • The infostealer component poses particular risk to:

  • Enterprise users with access to business applications
  • Financial service employees with credentials to banking systems
  • Healthcare professionals with access to patient management systems
  • Government contractors with classified or sensitive information access

    • ## Implications for Organizations


    The emergence of TELEPUZ underscores several troubling trends in the 2026 threat landscape:


    1. The Rise of Modular Malware

    Threat actors are increasingly adopting modular architectures, mirroring legitimate software development practices. This shift allows for faster iteration, easier maintenance, and customization at scale.


    2. ClickFix as a Persistent Vector

    Social engineering remains devastatingly effective. Unlike zero-day vulnerabilities that eventually get patched, human psychology exploits can be reused indefinitely.


    3. Supply Chain Risk

    The compromise of legitimate websites as distribution vectors means organizations cannot assume their users will only visit trusted platforms. The attacker's payload doesn't originate from obviously malicious infrastructure.


    ## Recommendations for Defense


    ### For Individual Users


  • Verify security warnings independently – Do not click links in in-page warnings; navigate directly to your antivirus vendor's website
  • Keep systems updated – Ensure Windows, browsers, and security software receive the latest patches
  • Use browser security extensions – Tools that detect malicious redirects and ClickFix lures can provide additional protection
  • Maintain healthy skepticism – If a warning appears unexpected, it's likely malicious

    • ### For Organizations


  • Deploy advanced threat detection – Behavioral analysis and sandboxing can catch modular malware that signature-based tools miss
  • Implement DNS filtering – Block known TELEPUZ C2 domains at the network perimeter
  • Segment networks – Limit lateral movement if a system becomes compromised
  • Conduct security awareness training – Specifically address ClickFix and social engineering tactics
  • Monitor and hunt – Search for indicators of compromise (IOCs) in network logs and endpoint telemetry
  • Incident response planning – Prepare for rapid containment if TELEPUZ is detected

    • ---


    ## HackWire Analysis


    TELEPUZ's emergence marks an inflection point in how malware is engineered and distributed. The combination of modular architecture plus ClickFix social engineering creates a particularly potent threat because it bypasses both technical and human defenses simultaneously.


    What makes this significant is not the malware's individual capabilities—data stealing and command execution have existed for years—but rather the operational efficiency of the distribution model. ClickFix exploits the fundamental problem that users cannot easily distinguish between legitimate security warnings and fake ones. A compromised website running ClickFix doesn't require the attacker to exploit a browser vulnerability or trick users into opening email attachments. Instead, legitimate traffic to legitimate websites becomes the infection vector.


    The modular approach is equally important: it means defenders are not hunting a single, fixed binary. The malware components are interchangeable, versioned, and updated dynamically by the C2 server. Today's signature for TELEPUZ's infostealer may not catch tomorrow's variant. This forces organizations to invest in behavioral detection and threat hunting rather than relying on reactive antivirus scanning.


    The timing is notable too. ClickFix campaigns have accelerated throughout 2026, and TELEPUZ represents a natural evolution: a threat actor combining a proven social engineering technique with a sophisticated payload designed for detection evasion and extensibility. This is not opportunistic malware—it's a mature tool with professional engineering behind it.


    For defenders, the immediate concern is clear: every website visit is now a potential infection vector. The secondary concern is harder to address: once TELEPUZ establishes persistence, the modular architecture means the attacker can deploy additional capabilities (ransomware, wiper, lateral-movement tools) weeks or months after initial compromise.


    Organizations should assume some systems are already compromised and shift focus to detection, containment, and rapid response. User education remains essential, but it alone cannot solve a problem where the attack surface is the entire internet.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Social Engineering](https://www.hackwire.news/category/phishing)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)