TELEPUZ: The New Malware Hiding Behind Fake 'Fix This' Website Pop-ups
A modular info-stealer is spreading through booby-trapped websites that trick visitors into pasting malicious commands into their own computers.
Key points
- Elastic Security Labs disclosed a new malware family called TELEPUZ that has been spreading since late April 2026.
- The malware reaches victims through ClickFix lures: fake error messages on hacked websites that trick people into running malicious commands themselves.
- TELEPUZ is modular, meaning attackers can plug in extra tools to steal data or run commands on the infected machine.
- Researchers say the number of attacker-controlled servers is small so far, but the pace of infections is climbing.
Security researchers at Elastic Security Labs have flagged a new piece of malicious software called TELEPUZ. Spreading since late April 2026, it arrives in an unusually sneaky way: the victim types the attack in themselves.
The trick is called ClickFix. A person lands on a hacked website and sees what looks like a normal error box, something like "Your browser is missing a component, run this to fix it." The page then asks them to press the Windows key plus R, paste a line of text, and hit Enter. That line is the malware. We covered the same delivery method in the REF6045 fraud campaign Elastic was tracking on 8 July.
It works because it doesn't look like an attack. No dodgy attachment to open, no download prompt to dismiss. The user is guided, step by step, into launching the code on their own machine.
What can TELEPUZ actually do to a victim's computer?
It can steal information and run further commands. First it grabs valuable data from the machine, then it opens a channel back to the attackers, letting them push new instructions later.
Elastic researcher Cyril François described the malware as "full-featured, lightweight, and modular": the core program is small, but attackers can bolt on extra pieces to do whatever they want next. The kind of data these tools go after includes saved browser passwords, session cookies (the small files that keep you logged in to sites like your email or bank), and cryptocurrency wallet files.
Session cookies are the quiet danger. If a criminal steals a valid cookie from your browser, they can often log in as you without needing your password and without triggering a two-factor prompt. Multi-factor authentication, the extra code from an app or text message, helps at login. It doesn't help when the attacker bypasses login entirely by reusing your active session.
According to Elastic's writeup, the malware currently talks to a small number of command-and-control domains, the servers attackers use to send orders to infected machines. That number is low today. The infection rate is not.
Should you worry if you use a Mac?
ClickFix variants aren't limited to Windows. Our 16 July story on ClickLock Stealer covered a Mac-targeting campaign using the same persuade-them-to-run-it-themselves approach. TELEPUZ as documented by Elastic targets Windows, but the underlying tactic travels.
What should ordinary users do?
The single most useful habit: never paste a command into a terminal because a website told you to. No legitimate site will ask you to do that to "verify" you're human or fix a video player. That prompt is the attack.
If you've already done it, assume passwords stored in your browser are exposed. Change the important ones from a different device, sign out of all sessions on your main accounts, and run a full antivirus scan. Watch your email and bank for anything you didn't do.
Elastic has published indicators of compromise on its research site: file names and server domains that defenders can block. The Hacker News first reported the technical details.
ClickFix has grown steadily across 2025 and into 2026 because it sidesteps most security tools. It doesn't need a software flaw. It just needs someone willing to follow instructions, which, it turns out, is most of us.
