Elastic Security LabsPublished
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
By Cyril François
Excerpt
Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure information we collected. The malware is full-featured, lightweight, and modular. While the number of C2 domains is currently small, the daily volume of builds uploaded to VirusTotal and the rapid pace of updates indicate active development and likely further growth.
Key takeaways
Full-featured malware, modular, fast evol…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Auditing the auditor: Unmasking Apex AcceleratorElastic Security Labs · Published 12 Oct
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RATElastic Security Labs · Published 14 Apr
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- Shedding light on the ABYSSWORKER driverElastic Security Labs · Published 20 Mar 2025
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
