A rapidly evolving malware family dubbed TELEPUZ, a modular and lightweight threat that is gaining traction through a ClickFix–VIDAR infection chain.
Despite a relatively small command-and-control (C2) footprint, the pace of development and distribution suggests an emerging large-scale operation.
The infection begins with ClickFix social engineering, where victims are tricked into executing a malicious PowerShell command under the guise of accessing web content.
This initial stage retrieves a second-stage payload from hxxps://memshowblob[.]forum/api/index.php?a=grab, which deploys a VIDAR variant.
VIDAR then downloads TELEPUZ components, including a stager (install.exe) and the main payload (telepuz.dll), typically hosted on domains such as hurgadatour[.]shop.
The TELEPUZ payload is a 64-bit DLL written in C, designed for stealth, modularity, and efficiency. It employs multiple obfuscation techniques, including garbage instructions, custom RC4-based string encryption, and import hashing.
Additionally, it leverages indirect syscalls by mapping a clean copy of ntdll.dll and constructing syscall trampolines, effectively bypassing API hooks and endpoint detection mechanisms.
Persistence is achieved by installing the malware as a service named “CipherAllocator,” often executed via rundll32.exe within svchost.exe contexts.
TELEPUZ also performs extensive anti-analysis checks, including virtual machine detection, debugger evasion using NtQueryInformationProcess and ThreadHideFromDebugger, and geofencing to avoid execution in CIS countries.
gbhackers.com
