TELEPUZ is a newly emerged modular malware-as-a-service (MaaS) detected in April 2026, spreading through infection chains involving CLICKFIX and VIDAR malware. It employs sophisticated evasion techniques including indirect system calls, unhooking of NTDLL, and anti-virtual machine checks to avoid detection. Persistence is achieved by installing itself as a service. TELEPUZ communicates with its command-and-control servers using WebSockets and downloads additional malicious modules that enable keylogging, credential theft, and web injection capabilities. The infection vector begins with social engineering tactics that convince victims to execute PowerShell commands, which deploy VIDAR as a second stage, subsequently delivering TELEPUZ components. The malware's infrastructure is limited but daily build volumes are high, indicating ongoing active development and expansion by likely a small team or solo developer offering malware-as-a-service.

The malware enables attackers to maintain persistent access on infected systems, steal credentials, log keystrokes, and perform web injection attacks. This can lead to significant data compromise and unauthorized access. The use of advanced evasion techniques makes detection and removal more challenging. The infection chain relies on social engineering, increasing the risk of user-targeted compromise. There are no known exploits in the wild beyond the described infection method.

No official patches or fixes are available as this is malware rather than a software vulnerability. Mitigation should focus on user education to prevent execution of unsolicited PowerShell commands and social engineering attacks. Endpoint detection and response solutions should be updated to detect indicators of compromise related to TELEPUZ and its infection chain components (CLICKFIX and VIDAR). Network monitoring for suspicious WebSocket communications to known command-and-control domains and IPs may help identify infections. Regular threat intelligence updates including the provided hashes and domains should be integrated into security controls. Since this is a MaaS offering, vigilance against emerging variants is advised.