When Copy and Paste Becomes the Attack: Understanding TELEPUZ and the Rise of ClickFix Malware
- Javier Conejo del Cerro
- hace 5 días
- 2 min de lectura
Cybercriminals no longer need sophisticated exploits to compromise a system.
Sometimes, all they need is a convincing error message and a user willing to press Ctrl+V.
TELEPUZ, a newly discovered modular malware distributed through ClickFix campaigns, demonstrates how social engineering has evolved beyond phishing. Instead of exploiting software vulnerabilities, it exploits human trust, turning an ordinary copy-and-paste action into the first stage of a sophisticated malware infection capable of stealing data, bypassing security controls, and maintaining persistent remote access.
Phase 1 – Convincing the User to Execute the Attack
The infection begins with a fake browser error, software update, or CAPTCHA verification page.
Victims are instructed to copy and paste what appears to be a harmless command into PowerShell. In reality, this ClickFix and pastejacking technique causes the victim to execute the attack manually, eliminating the need for traditional exploits while bypassing many security expectations.
The user becomes the initial execution mechanism.
Phase 2 – From Stealer to Full Malware Platform
The PowerShell command downloads a staged payload that ultimately deploys TELEPUZ.
Once running, the malware establishes persistence, elevates privileges, installs itself as a Windows service, and disables multiple defensive mechanisms, including AMSI, ETW, and DLL monitoring. It also performs anti-VM, anti-sandbox, and geolocation checks before fully activating.
Rather than behaving like a simple infostealer, TELEPUZ prepares the system for long-term compromise.
Phase 3 – Complete Control of the Compromised System
After establishing communication with its command-and-control infrastructure, TELEPUZ provides operators with an extensive set of capabilities.
The malware can execute commands, manage processes, browse and manipulate files, capture screenshots, record keystrokes, steal cookies from Chromium-based browsers, inject malicious web content, deploy additional payloads, and maintain resilient communication through multiple fallback C2 discovery mechanisms, including Telegram, Steam, DNS, and blockchain.
Its modular design makes the malware highly adaptable and difficult to disrupt.
Phase 4 – A Malware-as-a-Service Built for Growth
Elastic researchers observed continuous development, frequent new builds, and modular architecture that strongly suggest TELEPUZ is being developed as an emerging Malware-as-a-Service (MaaS) platform.
Although its infrastructure remains relatively small today, its rapid evolution, sophisticated evasion techniques, and flexible architecture indicate that its capabilities—and likely its customer base—will continue to expand.
The campaign reflects how modern malware increasingly combines social engineering with enterprise-grade engineering.
Defense Measures
Organizations should reduce the risk of ClickFix-style attacks by:
Training users never to execute commands copied from websites.
Monitoring PowerShell and command-line activity.
Detecting AMSI and ETW bypass attempts.
Restricting script execution through application control.
Monitoring privilege escalation and persistence mechanisms.
Detecting anomalous outbound communications and fallback C2 behavior.
Continuously educating users that copy-and-paste requests can be attack vectors.
Human behavior is now part of the attack surface.
Conclusions
TELEPUZ illustrates a significant shift in cyberattacks.
The objective is no longer to break into systems—it is to convince users to open the door themselves.
As technical defenses continue to improve, attackers increasingly rely on trust, routine, and familiarity to execute malicious code without exploiting a single software vulnerability.
The most dangerous command may no longer be the one written by an attacker.
It may be the one a victim willingly pastes into their own terminal.
The Hacker News
Comentarios