Dominic Jainy is a seasoned IT professional whose career spans the critical intersections of artificial intelligence, machine learning, and blockchain technology. With a keen eye for how emerging tech can be both a tool for progress and a weapon for threat actors, Dominic has become a go-to expert for understanding complex malware lifecycles and the evolving tactics of cybercriminal syndicates. Today, we sit down with him to discuss the alarming rise of the ClickFix campaign and the modular TELEPUZ malware, which has been rapidly evolving since its emergence in early 2026. This discussion explores the tactical shift toward user-assisted infection chains, the sophisticated use of decentralized command-and-control structures, and the specialized evasion techniques that make modern defensive perimeters feel increasingly porous.
Throughout this conversation, we examine the psychological manipulation behind fake browser verification pages that trick victims into manually executing malicious payloads. Dominic breaks down the modular architecture of TELEPUZ, explaining how its ability to download specific components like keyloggers and web-injectors allows it to remain stealthy while maintaining high utility for attackers. We also delve into the technical resilience of the malware, particularly its use of the Polygon blockchain and other fallback mechanisms to ensure its command-and-control infrastructure remains unreachable by law enforcement. Finally, the discussion provides concrete strategies for organizations to detect these threats, focusing on monitoring WebSocket traffic and unusual system call behaviors to prevent total browser-session theft.
How does the ClickFix campaign successfully manipulate human psychology to bypass technical defenses that would typically stop a standard malware download?
The brilliance, if you can call it that, of the ClickFix campaign lies in how it shifts the burden of execution from a hidden exploit to the user’s own hand. When a person encounters one of these fake browser verification pages, they aren’t looking at a suspicious file attachment; they see a prompt that mimics a routine security check or a technical fix. By instructing the user to copy a string and paste it directly into their PowerShell or Command Prompt, the attackers are effectively asking the victim to grant them administrative access under the guise of “fixing” a web error. This maneuver is devastatingly effective because it bypasses the automated sandboxing and email scanning that modern enterprises rely on for protection. It’s a sensory trap: the page looks official, the action feels technical yet simple, and the urgency of the “verification” bypasses the user’s natural skepticism. Once that command is executed, it triggers a multi-stage process where a Vidar-based second stage retrieves the TELEPUZ loader, turning a small moment of user confusion into a complete breach of the workstation’s integrity.
What makes the modular design of TELEPUZ particularly dangerous for security operations centers that are used to dealing with monolithic malware threats?
The modularity of TELEPUZ is a direct response to the “cat and mouse” game played between malware authors and security analysts. Since we first observed its activity in late April 2026, the malware has focused on staying incredibly lightweight during its initial infection phase. Instead of carrying a heavy payload of malicious features, it arrives as a stager that only downloads what the operator needs at that specific moment. This approach means that the initial file might not trigger any alerts for “known malicious behavior” because it doesn’t yet contain the keylogger or the browser-manipulation modules. We saw a sharp increase in activity starting in early June, suggesting the operators were rapidly expanding their library of available tools. With 36 different remote commands available, an attacker can pivot from simple file listing to complex data exfiltration or credential theft in seconds. It allows the malware to adapt to the specific environment it finds itself in, whether that involves extracting Chromium browser cookies or using a web-injector module to intercept financial form fields in real-time.
In your experience with blockchain technology, how does the use of a Polygon smart contract for command-and-control communication complicate the job of incident responders?
This is where my interest in blockchain and security really converges, and frankly, it is one of the most resilient C2 strategies I’ve seen in the wild. TELEPUZ primarily communicates through WebSockets using a JSON-based protocol, but it is built with an incredible array of fallbacks for when that primary connection is severed. If the main server goes down, the malware can seek out new instructions through a Telegram channel, a specific Steam profile, or even a Polygon blockchain smart contract. By using a decentralized ledger, the attackers create a “bulletproof” beacon that cannot be taken down by a domain registrar or a hosting provider. When the malware queries a contract address like 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, it is essentially looking at a permanent, unchangeable message board for its next set of instructions. This forces security teams to move beyond simple IP and domain blocking; they must now be prepared to monitor for unusual blockchain transactions or traffic to decentralized infrastructure, which is a significant hurdle for many traditional SOCs.
What specific technical maneuvers does TELEPUZ use to ensure it remains hidden on a system once the initial ClickFix command has been run?
The malware employs a deep layer of evasion and anti-analysis techniques that make it very difficult to root out once it takes hold. Before it even starts its malicious work, it performs a series of environment checks to see if it is running inside a sandbox, a virtual machine, or a debugger. If it detects it’s being watched, it simply won’t activate its core payloads. Furthermore, TELEPUZ uses encrypted strings and dynamic API lookups to hide its true intentions from static analysis tools. It even goes as far as using indirect system calls and specific patches designed to weaken the Windows antimalware scanning interface and event tracing for Windows. This effectively blinds the operating system’s internal security sensors. For persistence, it doesn’t just stay in a temporary folder; it copies itself as artifacts like AppData.dll or agent.dll, hijacks the rundll32.exe process, and even attempts to register a Windows service. These actions are designed to ensure that even if a user realizes something is wrong and tries to reboot, the malware remains firmly in control of the high-privileged access tokens it has stolen.
Given the complexity of this infection chain, what concrete steps should organizations take to mitigate the risk of a successful TELEPUZ deployment?
The most critical step is a fundamental shift in user training: employees must be taught that no legitimate website will ever ask them to copy and paste a command into a PowerShell or Run window. Beyond that, security teams need to get very aggressive about monitoring for unusual system behavior, specifically looking for rundll32.exe activity originating from temporary folders or outbound WebSocket traffic to unrecognized domains. If an infection is confirmed, the response cannot just be “clean the machine.” You have to treat it as a full-scale identity compromise. Because TELEPUZ is built to target browser credentials and session cookies, you must immediately revoke all active sessions, rotate every privileged credential, and review browser data for signs of manipulation. Implementing DNS and web filtering to block known staging domains like hurgadatour[.]shop or krabsburger[.]xyz is a good start, but the real defense lies in isolating suspected endpoints quickly to prevent the modular payloads—like the keylogger or the stealer module—from phoning home with stolen data.
What is your forecast for the evolution of modular, blockchain-enabled malware like TELEPUZ?
I believe we are entering an era where malware will become increasingly “platform-agnostic” and decentralized, making it nearly impossible to dismantle the infrastructure behind these campaigns. As we move deeper into 2026, the success of the TELEPUZ model will likely inspire other groups to adopt modular architectures that allow for real-time feature updates without needing to re-infect the target. We will see a more sophisticated use of browser debugging interfaces to hide malicious activities, moving away from noisy code injection toward stealthier methods that leverage the browser’s own built-in tools. Furthermore, the use of blockchain for C2 is going to move from a “fallback” to a primary method of communication, as it offers a level of permanence that traditional web hosting simply cannot match. For defenders, this means the focus must shift from blocking “known bad” indicators to a more behavioral-based approach that assumes the network is already compromised and looks for the subtle, persistent patterns of decentralized communication.