✨ The Containment Era is here. →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In late April 2026, a new modular malware named TELEPUZ began spreading through websites compromised with ClickFix lures. This malware, written in C, is lightweight and modular, indicating active development by a small team or solo developer. The infection chain starts with a ClickFix social engineering lure that downloads and executes a second-stage VIDAR Go variant, leading to the deployment of TELEPUZ. The malware employs various obfuscation techniques, including garbage instructions, import name hashing, string encryption, and indirect system calls, to evade detection. It also performs anti-VM and geolocation checks to avoid execution in sandboxed environments or unauthorized geographic locations. Once active, TELEPUZ disables security monitoring by unhooking NTDLL, turning off Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), and removing third-party DllNotification callbacks. The malware's modular design allows it to download additional components, such as keyloggers, stealers, and web injectors, enhancing its capabilities to steal sensitive data and execute arbitrary commands on infected systems. The rapid pace of updates and the steady volume of daily builds uploaded to VirusTotal suggest that TELEPUZ is likely offered under a malware-as-a-service (MaaS) model, posing a significant threat to organizations and individuals alike.

The emergence of TELEPUZ highlights the evolving sophistication of malware campaigns leveraging social engineering techniques like ClickFix. The use of modular malware-as-a-service models enables rapid development and deployment of new threats, making it imperative for organizations to stay vigilant and implement robust security measures to detect and prevent such infections.

Why This Matters Now

The emergence of TELEPUZ highlights the evolving sophistication of malware campaigns leveraging social engineering techniques like ClickFix. The use of modular malware-as-a-service models enables rapid development and deployment of new threats, making it imperative for organizations to stay vigilant and implement robust security measures to detect and prevent such infections.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

TELEPUZ is a modular, lightweight malware written in C, first identified in April 2026. It spreads through ClickFix lures and is capable of stealing sensitive data and executing arbitrary commands on infected systems.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to the TELEPUZ malware incident as it would likely limit the malware's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-aware policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: While Aviatrix Zero Trust CNSF may not prevent the initial execution of malicious commands, it would likely limit the malware's ability to communicate with external command-and-control servers, reducing the scope of the compromise.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Aviatrix Zero Trust Segmentation would likely limit the malware's ability to exploit elevated privileges by restricting access to sensitive resources, thereby reducing the potential impact of privilege escalation.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Aviatrix East-West Traffic Security would likely limit the malware's ability to move laterally by enforcing strict segmentation policies, thereby reducing the blast radius of the attack.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Aviatrix Multicloud Visibility & Control would likely limit the malware's ability to establish command-and-control channels by monitoring and controlling outbound communications, thereby reducing the attacker's control over the compromised system.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit the malware's ability to exfiltrate data by enforcing strict egress policies, thereby reducing the risk of data loss.

Impact (Mitigations)

Aviatrix Zero Trust CNSF would likely reduce the overall impact of the malware by limiting its ability to access critical systems and data, thereby constraining the attacker's objectives.

Impact at a Glance

Affected Business Functions

  • Data Security
  • System Integrity
  • User Credential Management
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $50,000

Data Exposure

Potential exposure of sensitive user credentials and personal information.

Recommended Actions

  • • Implement Zero Trust Segmentation to restrict lateral movement within the network.
  • • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
  • • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
  • • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
  • • Educate users on recognizing and avoiding social engineering attacks like ClickFix to prevent initial compromise.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image