Telepuz: The Modular Malware Turning VIDAR into a Criminal…

Elastic Security Labs analyzes Telepuz, a modular malware under active development and distributed as Malware-as-a-Service via a ClickFix-VIDAR infection chain. The three-stage architecture employs indirect syscalls and anti-VM checks to evade detection, while a high volume of daily builds on VirusTotal signals a low-barrier MaaS model.

{"main_topic":"malware","topics":["malware","infostealer","maas","clickfix","cybersecurity"]}

Telepuz, a modular malware under active development, is distributed as Malware-as-a-Service through an infection chain that leverages the ClickFix technique and the VIDAR infostealer as a secondary vehicle. The analysis published on July 16, 2026 by Elastic Security Labs documents a three-stage architecture with advanced evasion capabilities, including indirect syscalls patched into legitimate system libraries and anti-VM checks. The high number of daily builds uploaded to VirusTotal — 429 matches for the search term "telemetriawork" — indicates a MaaS model with active development and a low barrier to entry for less sophisticated operators.

Key Takeaways

Telepuz has operated since late April 2026 according to infrastructure data collected by Elastic Security Labs
The infection chain begins with ClickFix: the user copies and pastes a PowerShell command that downloads a VIDAR Go variant from the domain memshowblob[.]forum
VIDAR acts as a secondary downloader for the install.exe stager and the telepuz.dll payload, hosted on hurgadatour[.]shop
The malware employs indirect syscalls by generating trampolines patched into the .text section of legitimate Windows libraries such as dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, and secur32.dll

From ClickFix to Payload: The Three-Stage Chain

The infection begins with the ClickFix technique, a social engineering vector that tricks the user into manually copying and pasting a PowerShell command into a terminal window. This seemingly innocuous action bypasses many automated security filters because it requires a conscious action by the victim.

The PowerShell command downloads the second stage from hxxps://memshowblob[.]forum/api/index.php?a=grab. This is a VIDAR Go variant identified by SHA256 hash 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954, verifiable on VirusTotal.

VIDAR, traditionally classified as an infostealer, assumes a different role here: secondary downloader for the Telepuz platform. It downloads and executes two additional components from the same domain hurgadatour[.]shop: the install.exe stager and the main telepuz.dll payload.

The stager, a 13-15 KB PE with SHA256 hash 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746, handles loading and executing the main DLL via rundll32. The Telepuz payload, a 64-bit Windows shared library with 1-2 exports disguised as legitimate software names, is identified by hash 58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed.

Indirect Syscalls and Puppet Libraries: Evasion in Detail

The most refined evasion mechanism documented by Elastic Security Labs involves indirect syscalls. Telepuz maps a fresh copy of ntdll.dll, extracts native syscall numbers, generates trampolines, and patches them into the .text section of a random Windows library already loaded in the process.

Identified target libraries include dfscli.dll, davhlpr.dll, msdtclog.dll, dsrole.dll, and secur32.dll. This technique allows system calls to be executed through paths that do not appear directly suspicious to monitoring tools based on standard ntdll.dll hooks.

The malware also implements multiple anti-VM checks: it verifies that the CPU has at least 2 cores, RAM exceeds 2 GB, disk space is sufficient, and display device names do not match known hypervisor identifiers. An additional anti-debugger check compares the username and computer name against a list of typical sandbox identifiers. Finally, the malware verifies that the user LCID does not fall within a hardcoded list of CIS countries.

Command-and-control communication occurs via WebSocket, a protocol that enables persistent, bidirectional connections potentially harder to intercept than traditional HTTP polling requests.

Custom RC4 and Daily Builds: The MaaS Signatures

Telepuz uses a custom RC4 algorithm for string decryption, with constants that vary between samples. This variability, combined with the update cadence, complicates static signature extraction.

"Given the significant number of builds uploaded to VirusTotal daily, it is likely that we are dealing with a MaaS" — Elastic Security Labs

According to the source, the project is driven by a single developer or a very small team, with programming as their primary activity. A search for "telemetriawork" on VirusTotal returns 429 file matches associated with this family, an indicator of wide and frequent distribution. Persistence is installed in an %AppData% folder named "DCFG Runtime Themes Processor", using the mutex cfgmgr_mtx.

The source does not specify the exact nature of optional modules, noting that some components remain "still under development." The dossier does not document specific remedial measures released by security vendors.

Why It Matters

The dossier does not specify the actual number of victims or compromised entities, nor the precise geographic targeting beyond the exclusion of CIS countries. The exact identity of the MaaS operators — country of origin, affiliated criminal group — remains undetermined. No infrastructure overlaps linking the actor to known malware families have emerged to date.

The brief does not document the service's monetization model (pricing, sales channels, affiliate network) or details on the full modular ecosystem's capabilities. The presence of ransomware capabilities, specific data theft, or commercial remote access within the platform is not confirmed.

The source also does not specify whether the multiple builds reflect customizations for distinct clients or simply internal development iterations, a distinction that would have different implications for threat scalability.

From Infostealer to Infrastructure: A Consolidated Trend

The evolution documented by Elastic Security Labs signals a structural shift in the criminal market. VIDAR, until recently an autonomous credential theft operator, is here reduced to a fungible component of a broader chain. Telepuz represents the upper layer: a modular, updatable platform distributable to third parties.

The MaaS model lowers the skill threshold required to deploy advanced malware, while evasion techniques — indirect syscalls, anti-VM, anti-debugger — erode the traditional advantage of EDRs based on behavioral detection. The ClickFix vector, exploiting direct psychological manipulation rather than software vulnerabilities, remains particularly insidious precisely because it cannot be reduced to a technical patch.

A cadence of roughly one build per day suggests the project is still in an expansion phase. If the trend holds, the convergence of specialized criminal infrastructures could make it increasingly difficult to trace the origin, author, and purpose of individual infections.

Information is based on the cited source and current as of publication.

Sources

Sources and references