TELEPUZ Malware Spreads via ClickFix Social Engineering, Targets Windows with Modular Capabilities and Resilient C2 Infrastructure
Since the end of April 2026, compromised websites have been distributing a new modular malware called TELEPUZ through the ClickFix social-engineering technique. Attackers replace the usual browser-error remediation steps with instructions that prompt the victim to copy a command to the clipboard and manually paste and execute it in a Windows Run dialog or PowerShell window.
The delivered PowerShell command first fetches an intermediate loader, which in turn installs a variant of the Vidar infostealer before launching the main TELEPUZ payload through the legitimate Windows utility rundll32.exe.
Before performing any malicious actions, TELEPUZ inspects the target system’s hardware characteristics, operating-system language, username, and indicators of virtualization or debugging tools. If it detects a sandbox or analysis environment, the malware terminates itself to avoid detection.
After passing these checks, TELEPUZ disables selected Windows security mechanisms, attempts to obtain administrator and SYSTEM privileges, and establishes persistence by registering itself as a service hosted inside the legitimate svchost.exe process.
Communication with the attacker’s command-and-control server is performed over WebSocket. When the primary server becomes unavailable, the malware can locate backup addresses through several independent channels: encrypted links hidden in Telegram and Steam profiles, specially crafted DNS records, and data stored inside a Polygon blockchain smart contract. This multi-layered fallback design helps maintain control over infected devices even after the main infrastructure is taken down.
TELEPUZ provides a broad set of post-exploitation features, including the ability to browse and modify files, capture keystrokes, execute arbitrary commands, manage running processes, take screenshots, and download additional modules. A dedicated component extracts cookies from Chromium-based browsers and can inject arbitrary JavaScript into both Chromium and Firefox by abusing remote-debugging interfaces.
Elastic researchers assess that TELEPUZ is likely distributed under a malware-as-a-service model. Although the number of active command-and-control domains remains relatively small, the frequent release of daily builds and rapid updates indicates ongoing, active development. The observed C2 servers have been hosted on compromised websites located in Brazil and India.
Related articles
DDoS-Guard Reports Record 540,000 L7 Attacks in June 2026 Amid Botnet Fragmentation
DDoS-Guard recorded a sharp 70% increase in L7 attacks during Q2 2026, with June alone seeing 540,000 incidents. Global volumetric attacks doubled compared to all of 2025, including peaks of 1.64 Tbps and 1.58 Tbps. Law enforcement dismantled four major IoT botnets—Aisuru, KimWolf, JackSkid and Mossad—in March, yet long-duration L7 campaigns surged 380%. Attackers shifted focus to application-layer exhaustion using browser automation and AI agents while targeting HR platforms and news sites. Europol’s Operation PowerOFF led to 75,000 warnings and 53 domain takedowns across 21 countries. Experts attribute the June spike to attacks aimed at protection providers themselves rather than single domains.
Spyware-Laden Modified iOS Apps Distributed via Russian Telegram Channel, Kaspersky Discovers
Kaspersky researchers have identified modified versions of popular iOS applications that are being distributed through a Russian-language Telegram channel and contain a malicious spying module. The infected apps include a marketplace platform for selling goods, a photo editor, and a video viewing service, all offered as ad-free versions with extra free features. Attackers embed the spyware directly into legitimate IPA files, while some clean apps simply promote the same channel to funnel users toward the malicious downloads. Installation requires users to obtain a developer certificate and sign the app using tools such as eSign or Scarlet, or to sideload via a computer or jailbroken device, completely bypassing the App Store. Once launched, the malware collects device name, battery level, regional settings, memory information, jailbreak status, geolocation, carrier code, and screenshots before sending the data to the attackers, although it stops when the app is closed. Kaspersky advises users to obtain applications only from official stores or verified developer websites rather than random Telegram sources.
DarkSword Exploit Kit Expands to 180 Sites Targeting iPhone Users with Zero-Click Chain
The DarkSword exploit kit has scaled its infrastructure to 180 web properties hosted on 27 servers, enabling zero-click compromise of iPhones running vulnerable iOS versions. Attackers deploy fake pages impersonating Apple, AWS, and other popular services to trigger a six-vulnerability exploit chain that achieves remote code execution, sandbox escape, and privilege escalation on iOS 18.4 through 18.7. Once the device is compromised, GHOSTBLADE components extract data from the Keychain, iCloud files, Wi-Fi passwords, and other stored content before exfiltrating it to attacker-controlled panels. The malware deletes crash reports and forensic logs to hinder analysis and does not establish traditional persistence, limiting the window of data theft to a single visit. Infrastructure rotates rapidly, with five of seven administrative panels observed on July 30, 2026, having appeared only a week earlier, indicating frequent domain and host replacement to evade blocking.
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.