New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Back Thehackernews

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Thehackernews • July 16, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TELEPUZ Malware Emerges, Spreading via ClickFix Lures to Steal Data A new modular malware named TELEPUZ has been detected spreading since late April 2026. It uses ClickFix lures to trick users into executing malicious commands. The malware is lightweight and modular, likely developed by a small team and may be offered as malware-as-a-service. TELEPUZ employs obfuscation techniques to evade detection and disables security monitoring features. It performs anti-virtual machine checks and crashes debuggers before connecting to its command-and-control (C2) server. The C2 server can be accessed through various encrypted methods, including Telegram and blockchain smart contracts. Once connected, TELEPUZ can execute commands, log keystrokes, and extract cookies from browsers. Compromised websites in Brazil and India have been identified as hosting the malware. 3 sources 65

Extracted Entities

Attack Types (1)

Malware (2)

ClickFix Telepuz