TELEPUZ Spreads via ClickFix “Fix” Web Lures

How the Attack Worked

This attack uses a technique known as ClickFix, where a compromised website displays a fake browser error, software update prompt, or CAPTCHA verification. Instead of a normal click-through fix, the page instructs the visitor to copy a command into their clipboard and paste it into PowerShell or the Windows Run dialog. Because the malicious script is injected into the clipboard and the victim is guided to paste and execute it themselves, this method is also called pastejacking.

Once the victim runs the pasted command, PowerShell downloads a second-stage payload from a remote URL and executes it. This chain ultimately launches TELEPUZ via rundll32.exe. TELEPUZ has been spreading through compromised sites using this lure since late April 2026, with campaign components retrieved from a specific attacker-controlled domain.

Why It Succeeded

The strength of ClickFix lies in shifting the actual execution step to the victim. Traditional security controls that look for malicious downloads or attachments can miss this pattern because the user is the one pasting and running the command, often believing they are resolving a routine technical issue like a browser error or CAPTCHA glitch. The instructions are framed as helpful, everyday troubleshooting steps rather than obviously suspicious actions.

TELEPUZ also builds in resilience: if its direct command-and-control communication fails, it can retrieve fallback C2 details from public platforms such as Telegram, Steam, DNS, and even a Polygon smart contract. This layered approach to command-and-control makes the malware harder to fully disrupt even if one channel is blocked.

What to Watch For

• A website that instructs you to copy and paste a command to fix an error or verify you are human
• Unexpected prompts to open PowerShell or the Windows Run dialog from a browser page
• Fake browser error, software update, or CAPTCHA messages that require manual command execution rather than a simple click

TELEPUZ itself is capable of keystroke logging, taking screenshots, stealing cookies, and executing further commands once it is running, so the consequences of following one of these prompts can extend well beyond the initial site visit.

Building Resistance

Organizations across all roles, including executives, finance, HR, customer support, and IT helpdesk staff, should be trained to recognize that a legitimate website fix never requires pasting and running commands. Employees should be encouraged to close the tab and report unexpected verification or error pages rather than following the on-screen steps. Reinforcing that manual, user-driven actions can still deliver malware is central to resisting ClickFix-style lures like the one used to distribute TELEPUZ.

What is ClickFix and how does it relate to TELEPUZ?

ClickFix is a technique where compromised websites trick users into manually pasting and running malicious commands disguised as fixes for fake browser errors, software updates, or CAPTCHA verifications. This chain is used to deliver TELEPUZ malware.

What can TELEPUZ do once installed?

TELEPUZ supports data theft and remote control actions such as keystroke logging, screenshots, cookie theft, and command execution.

How does the infection chain work technically?

The ClickFix lure leads to PowerShell execution, which downloads and runs a second-stage payload that ultimately launches TELEPUZ via rundll32.exe.

What should employees watch for to avoid this attack?

Be suspicious of any website instructing you to copy, paste, and run a command, especially in PowerShell or the Windows Run dialog, to fix a browser error or verify a CAPTCHA.