The TELEPUZ malware campaign shows how ClickFix-style social engineering is becoming one of the most effective ways to turn normal users into malware installers.

TELEPUZ is a new modular malware family spreading through compromised websites that display fake verification or error-fix prompts. These lures typically tell users to copy and paste a command into Windows Run, PowerShell, or another command interface. Once the user follows the instruction, the malware chain begins.

This is important because the attack does not depend only on exploiting a software vulnerability. It exploits user trust, urgency, and confusion. The victim believes they are fixing a browser issue, completing a verification step, or passing a security check. In reality, they are manually executing the attacker’s command. Humanity, once again, has invented a way to make malware installation feel like troubleshooting.

TELEPUZ has been linked to ClickFix-to-VIDAR infection chains, where the initial lure can lead to credential theft and follow-on payload delivery. The malware is described as lightweight, modular, and actively developed, which means attackers can add or change capabilities without rebuilding the entire threat.

That modular design makes TELEPUZ more dangerous. A modular malware platform can load different components depending on the victim, environment, or attacker objective. One victim may be used for credential theft. Another may receive keylogging. Another may be used for web injection, command execution, or further access. This flexibility makes detection and response harder because not every infection will behave exactly the same way.

The reported capabilities include data theft, remote command execution, keylogging, web-injection functionality, anti-analysis checks, and evasion techniques. Some reporting also notes attempts to interfere with security monitoring, including disabling or bypassing Windows telemetry and detection interfaces. That shows the malware is designed not only to steal, but also to survive long enough to be useful.

For businesses, the biggest risk is credential exposure. TELEPUZ and similar malware can steal browser data, saved passwords, session cookies, cryptocurrency wallet information, authentication tokens, and other sensitive data from infected endpoints. Stolen session cookies are especially dangerous because they may allow attackers to access accounts without needing the password again.

If the infected device belongs to an employee, the impact may extend to email, cloud platforms, VPN access, SaaS applications, internal dashboards, developer tools, finance portals, and customer systems. A single infected workstation can therefore become the starting point for business email compromise, data theft, cloud compromise, or ransomware deployment.

Organizations should treat ClickFix attacks as a serious user-awareness and endpoint-control problem. Users must be clearly trained that legitimate websites, CAPTCHA pages, browser checks, and security verifications do not require copying commands into Windows Run or PowerShell. This rule should be simple and absolute: never paste commands from a website into the operating system.

Security teams should monitor for suspicious use of PowerShell, mshta, rundll32, wscript, cscript, curl, certutil, bitsadmin, and other living-off-the-land tools commonly abused in staged infections. They should also watch for unusual child processes launched from browsers, command shells started by non-technical users, abnormal WebSocket traffic, unexpected downloads into temporary folders, and connections to unfamiliar command-and-control infrastructure.

Endpoint controls should restrict script execution where possible, enforce application allowlisting, block risky command patterns, and reduce local administrator privileges. Browser protection, DNS filtering, web reputation controls, and isolation for unknown sites can also reduce exposure to compromised webpages hosting ClickFix lures.

If TELEPUZ infection is suspected, organizations should not limit the response to malware removal. They should assume credentials, cookies, tokens, and browser-stored secrets may have been stolen. Passwords should be changed from a clean device, active sessions should be revoked, tokens and API keys should be rotated, and cloud and SaaS logs should be reviewed for suspicious access.

The key lesson is that ClickFix attacks succeed because they disguise execution as assistance. They do not ask the user to open a suspicious attachment; they ask the user to “fix” a problem. That makes the lure feel practical and urgent. TELEPUZ shows that this social-engineering model is now being paired with modular malware capable of theft, persistence, evasion, and remote control.

Organizations cannot rely only on users spotting bad grammar or strange attachments. Attackers are building cleaner pages, better instructions, and more convincing flows. Defenses must combine awareness, endpoint controls, script restrictions, monitoring, and rapid credential revocation.

The uncomfortable truth is simple: any website that tells a user to paste a command into Windows should be treated as hostile by default. Real verification checks do not need shell access. If a page asks for that, it is not helping the user fix a problem. It is turning the user into the installation wizard.

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a technical report. "While the number of C2 [command-and-control] domains is currently small, the daily

Source: New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands via The Hacker News — published 16 Jul 2026.