TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

Elastic Security Labs describes TELEPUZ, an actively developed modular Windows malware family propagated via a ClickFix social-engineering page and a VIDAR second-stage; TELEPUZ uses sophisticated evasion (indirect syscalls, NTDLL unhooking, AMSI/ETW patching), multiple UAC and privilege-escalation methods, WebSocket-based C2 with fallback resolution via Telegram/Steam/DNS/Polygon smart contract, and download-on-demand modules (keylogger, stealer, web injector, Chrome cookie extractor). The report provides technical analysis, command/URI/module mappings, persistence and installation details, sample hashes, staging/C2 domains, and a YARA rule and IOCs for detection and hunting.