Evolution of the ClickFix Delivery Model
According to The Hacker News, cybersecurity researchers have identified a new modular threat dubbed TELEPUZ that has been active since late April 2026. This malware utilizes a distribution technique known as ClickFix, which represents a sophisticated evolution of traditional Phishing tactics. Unlike standard email-based lures, ClickFix campaigns compromise legitimate websites to display fraudulent error messages. These overlays typically inform the user that a browser update is required or that a system error has occurred, providing instructions to copy and execute a PowerShell script to “fix” the issue.
This method bypasses many traditional email security controls by leveraging the reputation of compromised web domains. When a user follows the instructions, they inadvertently execute a malicious command string that downloads and installs the TELEPUZ stager. The use of social engineering to compel manual user execution is a hallmark of the ClickFix model, making ClickFix social engineering mitigation a high priority for organizations that rely on browser-based workflows.
TELEPUZ Modular Malware Analysis
Research from Elastic Security Labs, led by Cyril François, characterizes TELEPUZ as a “full-featured, lightweight, and modular” threat. The modular architecture allows the attackers to deploy specific components based on the target environment or the objectives of the campaign. During the initial infection phase, the malware establishes a footprint on the system and begins communicating with its C2 infrastructure.
While the current number of active command-and-control domains remains relatively small, researchers have observed consistent daily activity, suggesting an ongoing and managed campaign. The primary capabilities of TELEPUZ include the theft of sensitive data—such as browser credentials, session cookies, and system metadata—and the ability to execute arbitrary commands remotely. This versatility enables the threat actors to use TELEPUZ as a primary data stealer or as a secondary downloader for more intrusive payloads, such as ransomware or persistent backdoors. The lightweight nature of the code helps it evade some signature-based detection engines, necessitating more advanced behavioral monitoring.
How to Detect TELEPUZ Malware Infection
Detecting TELEPUZ requires a multi-layered approach that combines network-level visibility with endpoint behavioral analysis. Security teams should prioritize monitoring for suspicious PowerShell executions, particularly those involving the Clip.exe utility or commands that interact with the system clipboard, as these are frequently used in the ClickFix execution chain.
To effectively detect TELEPUZ malware infection, SOC analysts should look for outbound connections to newly registered domains or known malicious IoC addresses identified in recent research reports. Implementing EDR policies that flag the execution of obfuscated scripts originating from browser processes can significantly reduce the window of exposure. Furthermore, integrating these telemetry sources into a SIEM allows for the correlation of disparate events, such as a user visiting a compromised site followed immediately by an anomalous PowerShell event. Mapping these activities against the MITRE ATT&CK framework can help defenders visualize the attack path and identify gaps in their current defensive posture.
Recommendations for Defenders
Defending against modular threats like TELEPUZ requires both technical controls and user education. Organizations should implement the following measures:
- Enhance Web Filtering: Use reputation-based web filtering to block access to known compromised sites and newly registered domains that lack a clear business purpose.
- Disable Unnecessary Scripting: Where possible, restrict the execution of PowerShell for non-administrative users or enforce Constrained Language Mode via AppLocker.
- User Training: Educate employees on the dangers of “copy-paste” troubleshooting instructions found on websites. No legitimate software provider will ask a user to run PowerShell commands from a browser pop-up to fix a rendering error.
- Credential Hygiene: Since TELEPUZ focuses on data theft, implementing Zero Trust principles and multi-factor authentication (MFA) can mitigate the impact of stolen credentials.
As the threat continues to evolve, maintaining an up-to-date threat intelligence feed is essential for identifying the latest C2 domains and payload variations associated with TELEPUZ.
Related: Cyber Insurance Market Shifts: Rates Drop, Exclusions Widen, ClickFix Campaigns Expand Delivery with New Loaders and Fake Lures