New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

A new modular malware named TELEPUZ has been spreading since April 2026 via ClickFix social engineering lures, which use clipboard hijacking (pastejacking) to trick users into executing malicious PowerShell commands. The malware, written in C, performs anti-analysis checks, disables security monitoring, and establishes persistent command-and-control (C2) communication using multiple fallback methods. It is capable of data theft, command execution, and browser manipulation via Chrome DevTools Protocol, and is likely offered as malware-as-a-service (MaaS) based on active development and distribution patterns.

AI-extracted · verify before operational use