TELEPUZ Web Injector Can Steal Cookies, Execute JavaScript, and Replace IBAN Details

TELEPUZ is a modular, stealthy 64‑bit DLL malware observed being distributed through a ClickFix social engineering → VIDAR chain; it uses advanced evasion (garbage instructions, custom RC4 string encryption, import hashing, mapped ntdll/syscall trampolines), disables AMSI/ETW, achieves persistence as a service, and includes a powerful WebInjector module that manipulates browser debugging interfaces to intercept and alter financial transactions. The report documents active infrastructure and many IOCs (domains, IPs, VirusTotal submissions), fallback C2 mechanisms (Telegram/Steam/blockchain), and signs of a potentially MaaS-style, rapidly evolving campaign posing a significant financial fraud and credential-theft risk.