Blog / Malware & Threat Advisories
TELEPUZ and ClickFix: the new malware that talks your employees into installing it
Security researchers at Elastic Security Labs are tracking a new malware family called TELEPUZ — a modular, rent-by-the-month "malware-as-a-service" toolkit active since late April 2026. The malware itself is nasty (more below), but the part every business owner should understand is how it gets in: it doesn't exploit a software flaw. It politely asks your employee to install it — and it works often enough that this delivery trick, called ClickFix, has become one of the most common infection methods on the internet.
ClickFix: the attack that outsources the hacking to your staff
Here's the scene. An employee lands on a compromised or malicious web page — from a search result, an ad, or an email link. Instead of a virus download, they get a convincing roadblock: a fake CAPTCHA ("Verify you are human"), a fake browser error, or a fake "your document can't be displayed" message. The page then offers the fix: "Press Windows+R, paste this, and hit Enter."
That pasted text is a PowerShell command. The employee runs it themselves, on their own machine, with their own permissions. No attachment was opened, no installer was downloaded from a warning-covered page — so many of the usual guardrails never trigger. The user did the hacking for the attacker; the attacker just supplied instructions.
It's the same social-engineering playbook we described in how phishing gets past your spam filter — attackers routing around technology by targeting the human — applied to malware delivery instead of passwords.
What TELEPUZ actually does
In the chain Elastic documented, that pasted command downloads a variant of the Vidar infostealer, which grabs what it can and then installs TELEPUZ itself. TELEPUZ is small, professionally built, and modular — it phones home and pulls down extra capabilities on demand:
- A keylogger — recording whatever gets typed, including passwords.
- A credential stealer — harvesting saved logins, cookies, and session data.
- A web injector — the scary one. It can reach directly into the browser, steal live session cookies, run its own code on pages the user has open, and silently rewrite banking details in web forms — researchers found default configurations targeting IBAN fields. An employee paying an invoice sees the right screen; the money goes to the wrong account.
Because it's sold as a service, TELEPUZ isn't one gang — it's a product any criminal can rent, with updates shipping almost daily. Expect it (and imitators) to stick around.
How a business actually defends against this
1. Give your team the one rule that kills ClickFix
No legitimate website will ever ask you to press Windows+R and paste a command. Not to prove you're human, not to fix an error, not to view a document. Ever. That single sentence, repeated until it's reflex, defeats the entire delivery mechanism. Share it in your next team meeting — it takes thirty seconds.
2. Let EDR watch for the behavior
When a browser-spawned PowerShell command starts downloading executables, that's exactly the kind of behavior endpoint detection and response exists to flag and kill — regardless of whether the malware is brand new. Signature-based antivirus struggles with a toolkit that ships fresh builds daily; behavior-based detection doesn't care what the file is called. This is the case we made in why your business needs EDR and MDR, and ClickFix chains are a textbook example.
3. Cut the phone line with DNS filtering
Every stage of this chain — the fake page, the payload download, the WebSocket connection back to the operators — depends on domain lookups. Protective DNS can break the chain before the payload ever arrives, or strand the malware with no way to phone home.
4. Verify payment changes out-of-band — always
TELEPUZ's IBAN-swapping module is a reminder that the screen can lie. Any change to payment details — a vendor's new account number, an unfamiliar beneficiary — gets verified by phone to a known number before money moves. That policy costs nothing and defeats the most expensive thing this malware does.
5. Assume a click will eventually happen
Someone, someday, will paste the command. Restricting what standard users can run, keeping browsers and systems patched, and maintaining tested, separated backups turn that day into an incident report instead of a catastrophe.
The takeaway
TELEPUZ is new; the lesson isn't. Modern malware increasingly gets installed by the victim, invited in through a fake fix-it prompt — and once inside, it goes after money in motion, not just files. The defense is layered and boring: one clear rule for humans, EDR watching behavior, DNS filtering cutting connections, and out-of-band verification guarding payments.
All of those layers are standard on our managed IT plans and managed cybersecurity service. If you're not certain your business would catch a ClickFix attack, talk to us — we'll walk you through where you stand.