Malware News TELEPUZ Web Injector Can Steal Cookies, Execute JavaScript, and Replace IBAN Details

[Brownie2019]

Content source

https://gbhackers.com/telepuz-web-injector/

A rapidly evolving malware family dubbed TELEPUZ, a modular and lightweight threat that is gaining traction through a ClickFix–VIDAR infection chain.

Despite a relatively small command-and-control (C2) footprint, the pace of development and distribution suggests an emerging large-scale operation.

The infection begins with ClickFix social engineering, where victims are tricked into executing a malicious PowerShell command under the guise of accessing web content.

This initial stage retrieves a second-stage payload from hxxps://memshowblob[.]forum/api/index.php?a=grab, which deploys a VIDAR variant.

VIDAR then downloads TELEPUZ components, including a stager (install.exe) and the main payload (telepuz.dll), typically hosted on domains such as hurgadatour[.]shop.

The TELEPUZ payload is a 64-bit DLL written in C, designed for stealth, modularity, and efficiency. It employs multiple obfuscation techniques, including garbage instructions, custom RC4-based string encryption, and import hashing.

Additionally, it leverages indirect syscalls by mapping a clean copy of ntdll.dll and constructing syscall trampolines, effectively bypassing API hooks and endpoint detection mechanisms.

Persistence is achieved by installing the malware as a service named “CipherAllocator,” often executed via rundll32.exe within svchost.exe contexts.

TELEPUZ also performs extensive anti-analysis checks, including virtual machine detection, debugger evasion using NtQueryInformationProcess and ThreadHideFromDebugger, and geofencing to avoid execution in CIS countries.

Read the full Story:

https://gbhackers.com/telepuz-web-injector/

 

[Bot]

Read the full Story:

https://gbhackers.com/telepuz-web-injector/

Defensive Takeaways

This report describes a potentially serious infection chain, but the claims should be treated as third-party reporting until corroborated by additional reputable malware-analysis sources. The technical details alone do not prove that every referenced domain, file, or indicator is malicious.

The main risk comes from the initial ClickFix technique: users are socially engineered into pasting and executing a PowerShell command. Organizations should specifically monitor for:

• PowerShell launched from browsers, Office applications, or unusual user processes
• Encoded or heavily obfuscated PowerShell commands
• PowerShell downloading or executing content from newly registered or low-reputation domains
• Unexpected use of rundll32.exe, regsvr32.exe, or svchost.exe
• New services with unusual names, DLL paths, or execution parameters
• Unsigned DLLs loaded from user-writable directories such as %TEMP%, %APPDATA%, or %PUBLIC%

Recommended Actions

• Do not visit or download from the URLs in the quoted report. The indicators are included for awareness and should remain defanged.
• Block the listed domains and URLs at DNS, proxy, and endpoint-control layers after validating them against your organization’s telemetry.
• Enable PowerShell Script Block Logging, Module Logging, and appropriate process-creation auditing.
• Review recent service creation events, especially service names and binary paths that do not match approved software.
• Search endpoint telemetry for the reported filenames, including install.exe and telepuz.dll, but do not rely on filenames alone because they are easily changed.
• Submit suspicious files or URLs to VirusTotal or your security vendor, observing your organization’s privacy policy before uploading confidential samples.
• If an endpoint may have executed the command, isolate it from the network, preserve relevant logs, and perform an offline or trusted boot-media scan.

Indirect syscalls and anti-analysis techniques can reduce the visibility of traditional user-mode monitoring, but they do not make a system invisible. File provenance, service creation, process ancestry, network connections, memory activity, and endpoint telemetry remain useful for detection.

The safest conclusion is that this is a ClickFix-focused threat report that warrants defensive monitoring, but the specific TELEPUZ attribution and indicators should be independently validated before being treated as confirmed.

 

[LinuxFan58]

@Bot sound advice "Do not visit or download from the URLs in the quoted report.¨

Similar advice is often given by sergeants to soldiers in war movies telling them "be careful out there, don´t get killed¨. It is truely the ultimate survival advice which also applies in the digital world: "do not visit malicious websites".

Thanks for the insight, you lightened my day