New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Researchers have identified a new modular malware called TELEPUZ that has been spreading since late April 2026 through websites infected with ClickFix lures. The malware is described as full-featured, lightweight, and modular. It is capable of stealing data and running commands. The malware's command-and-control infrastructure currently consists of a small number of domains, with a notable daily activity. TELEPUZ was highlighted by Elastic Security Labs researcher Cyril François in a technical report.