TELEPUZ Malware Spreads via ClickFix Social Engineering, Targets Windows with Modular Capabilities and Resilient C2 Infrastructure
Since the end of April 2026, compromised websites have been distributing a new modular malware called TELEPUZ through the ClickFix social-engineering technique. Attackers replace the usual browser-error remediation steps with instructions that prompt the victim to copy a command to the clipboard and manually paste and execute it in a Windows Run dialog or PowerShell window.
The delivered PowerShell command first fetches an intermediate loader, which in turn installs a variant of the Vidar infostealer before launching the main TELEPUZ payload through the legitimate Windows utility rundll32.exe.
Before performing any malicious actions, TELEPUZ inspects the target system’s hardware characteristics, operating-system language, username, and indicators of virtualization or debugging tools. If it detects a sandbox or analysis environment, the malware terminates itself to avoid detection.
After passing these checks, TELEPUZ disables selected Windows security mechanisms, attempts to obtain administrator and SYSTEM privileges, and establishes persistence by registering itself as a service hosted inside the legitimate svchost.exe process.
Communication with the attacker’s command-and-control server is performed over WebSocket. When the primary server becomes unavailable, the malware can locate backup addresses through several independent channels: encrypted links hidden in Telegram and Steam profiles, specially crafted DNS records, and data stored inside a Polygon blockchain smart contract. This multi-layered fallback design helps maintain control over infected devices even after the main infrastructure is taken down.
TELEPUZ provides a broad set of post-exploitation features, including the ability to browse and modify files, capture keystrokes, execute arbitrary commands, manage running processes, take screenshots, and download additional modules. A dedicated component extracts cookies from Chromium-based browsers and can inject arbitrary JavaScript into both Chromium and Firefox by abusing remote-debugging interfaces.
Elastic researchers assess that TELEPUZ is likely distributed under a malware-as-a-service model. Although the number of active command-and-control domains remains relatively small, the frequent release of daily builds and rapid updates indicates ongoing, active development. The observed C2 servers have been hosted on compromised websites located in Brazil and India.
Related articles
AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.
Manic Android Malware Steals PINs via Transparent Overlay and Relays Data Through Nearby Infected Devices
A newly identified Android malware strain named Manic merges banking trojan, spyware, and remote access capabilities. The threat has been active since at least February 2026 and continues to receive updates that add anti-analysis features, in-memory code loading, and lock-screen credential theft. Manic monitors 169 financial, messaging, and government applications while using a transparent overlay on legitimate numeric keyboards to capture PINs without displaying a full fake banking screen. Stolen data can be forwarded through other compromised nearby devices even when the original phone lacks internet connectivity. Operators also leverage WebRTC sessions for live screen viewing and remote interaction. The malware additionally functions as a keylogger, intercepts SMS and notifications, and collects passwords, one-time codes, and recovery phrases. Security researchers recommend avoiding unknown APKs and scrutinizing requests for Accessibility Services or broad device control permissions.
Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development
The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.