Meet TELEPUZ: A New Modular Threat on the Block
Cybersecurity researchers have flagged a fresh modular malware strain called TELEPUZ that’s been riding the coattails of ClickFix lures on compromised websites since late April 2026. It’s not the flashiest name, but the threat is real — and it’s designed to do serious damage.
Elastic Security Labs researcher Cyril François broke down the findings in a technical report, describing TELEPUZ as “full-featured, lightweight, and modular.” That’s a dangerous combo. It means the malware packs a punch without being bloated, and its modular design lets attackers swap in new capabilities on the fly.
Here’s the kicker: while the number of command-and-control (C2) domains is currently small, the daily evolution of the infrastructure suggests this thing is scaling up fast. Early days, but the trajectory is worrying.
How ClickFix Lures Work: The Entry Point
ClickFix isn’t new, but it’s become a favorite social engineering trick. Attackers inject fake error prompts or CAPTCHA-style popups into compromised websites. When a visitor clicks, they’re instructed to copy a malicious payload and paste it into a terminal or PowerShell window. Boom — the malware gets a foothold.
In TELEPUZ’s case, the lures are embedded in sites that have already been hacked. The user thinks they’re solving a CAPTCHA or fixing a browser error. Instead, they’re executing a command that downloads the malware straight onto their machine.
It’s a low-friction attack. No phishing email, no malicious attachment — just a convincing popup on a site the victim already trusts.
What TELEPUZ Does Once It’s In
TELEPUZ isn’t a one-trick pony. According to François’s analysis, the malware is built to do two main things: steal data and run remote commands. But the modular architecture means those are just the starting points.
Data Theft Capabilities
The malware is designed to harvest sensitive information from infected systems. That could include credentials, browser cookies, or other valuable data. The lightweight design means it can run quietly in the background without drawing too much attention.
Remote Command Execution
Beyond theft, TELEPUZ can execute commands sent from its C2 servers. This gives attackers a direct line into the infected machine, letting them move laterally, drop additional payloads, or wreak havoc in real time.
The modular nature is what makes this particularly sneaky. Attackers can add new modules as the campaign evolves, meaning the threat landscape could shift quickly.
Infrastructure: Small Now, Growing Fast
François noted that the C2 infrastructure is currently limited to a small number of domains. But that’s not a reason to breathe easy. The daily changes in infrastructure signal active development and expansion.
This is a campaign that’s still in its early innings. Security teams should expect the C2 count to grow, and the attack methods to evolve as the operators refine their playbook.
Protecting Yourself Against ClickFix and TELEPUZ
So what can you do? The attack vector relies on social engineering, so awareness is your first line of defense.
- Think before you click: If a website asks you to copy-paste a command into your terminal or PowerShell, stop. Legitimate sites don’t do that.
- Keep your browser updated: Many ClickFix lures exploit browser vulnerabilities. Patching those closes the door.
- Use endpoint detection tools: Security solutions that monitor for unusual command execution can catch TELEPUZ before it takes hold.
- Verify site integrity: If a trusted site suddenly shows odd popups, it might be compromised. Leave and report it.
For security teams, the takeaway is to stay vigilant. The modular malware trend is growing, and TELEPUZ is the latest example. Monitoring C2 domains and watching for ClickFix lures on your users’ frequently visited sites can help you stay ahead.
The Bottom Line on TELEPUZ
TELEPUZ is a reminder that cyber threats keep getting more sophisticated. It’s lightweight, modular, and spreading through a social engineering trick that’s hard to spot. The small C2 footprint today could be a full-blown botnet tomorrow.
Stay sharp out there. And next time a website tells you to paste a command into your terminal — just say no.
