TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

Elastic Security Labs describes TELEPUZ, an actively developed, lightweight and modular Windows malware (likely offered as MaaS) propagated via a ClickFix → VIDAR chain; it features indirect syscalls, AMSI/ETW unhooking, UAC and privilege escalation bypasses, persistence as a service, WebSocket/TLS C2 communications with multi-method fallback (Telegram, Steam, DNS, Polygon smart contract), and downloadable modules for keylogging, stealing, and web injection — multiple staging domains and hashes are provided as IOCs.