How to remove TELEPUZ RAT from the operating system

What kind of malware is TELEPUZ?

TELEPUZ is a modular Malware-as-a-Service (MaaS) platform that combines Remote Access Trojan (RAT) functions with information-stealing capabilities. Written in C and deployed as a 64-bit Windows DLL, it runs silently in the background while giving attackers full remote control of infected systems.

According to research published by Elastic Security Labs, TELEPUZ is distributed through ClickFix - a social-engineering technique where a malicious website tricks the visitor into pasting a PowerShell command into the Run dialog, silently fetching and installing the malware.

Once active, TELEPUZ can steal browser credentials and cookies, log keystrokes, inject code into banking websites, capture screenshots, and let operators send commands remotely. It supports 36 distinct commands, giving attackers near-total control of a compromised device.

TELEPUZ overview

Elastic Security Labs first identified TELEPUZ in late April 2026, with build volume growing steadily from early June onward. New samples appear on VirusTotal on a near-daily basis, pointing to active development. The project appears to be run by a small team or a solo developer.

TELEPUZ is structured around a lightweight core and optional modules that operators can push to infected devices on demand. Confirmed modules include a keylogger, a browser credential stealer, and a web injector. Each module is a separate binary fetched from the operator's server when needed.

The ClickFix delivery chain begins on a compromised or attacker-controlled web page. When the victim runs the pasted PowerShell command, a Go-based VIDAR stealer variant is downloaded as an initial loader. That loader then retrieves and launches the TELEPUZ stager and its main payload from attacker-controlled domains.

TELEPUZ's capabilities

TELEPUZ supports 36 remote commands covering a wide range of malicious actions. Operators can perform process injection, list and terminate processes, upload or download files, capture screenshots, run shell commands, and escalate privileges to Administrator or SYSTEM level.

The web injector module uses the Chrome DevTools Protocol and the Firefox WebDriver BiDi interface to intercept and modify pages inside the victim's browser in real time. This lets the attacker silently alter banking and financial site pages - for example, swapping input fields to capture typed credentials without the user noticing anything wrong.

The stealer module pulls saved cookies from Chromium-based browsers and Firefox. The keylogger module records everything the user types. All captured data is sent back to the operator through the malware's command-and-control channel.

Command and Control communication

TELEPUZ communicates with its operators via WebSocket, with optional TLS encryption. Commands and responses follow a JSON structure. Each infected device is assigned a unique session ID derived from hardware serial numbers, the computer name, and the OS install date.

If the primary server becomes unreachable, TELEPUZ falls back to retrieving updated server addresses from a Telegram channel, Steam profile pages, or DNS records. It can also query a Polygon blockchain smart contract as a last resort. These multiple fallback paths make it resilient against infrastructure takedowns.

Persistence and defense evasion

TELEPUZ installs itself as a Windows service named CipherAllocator to survive reboots. It also modifies the Windows Registry as a secondary persistence mechanism, making simple process-level removal insufficient to fully clean the system.

To evade security software, TELEPUZ patches Antimalware Scan Interface (AMSI) and ETW (Event Tracing for Windows) in memory, and replaces the NTDLL library with a clean copy from disk to remove hooks placed by security tools. These steps prevent antivirus software from monitoring the malware's activity.

Before running its main code, TELEPUZ performs a series of anti-analysis checks. It reads CPU core count, RAM size, and disk space to detect virtual machines commonly used by security researchers. It also scans for known sandbox usernames, computer names, and hypervisor identifiers, and detects hardware breakpoints.

Geographic filtering prevents TELEPUZ from running on systems with a CIS-country locale. A User Account Control (UAC) bypass via COM elevation and the AppInfo ALPC interface allows privilege escalation without triggering a Windows prompt. Indirect syscalls, garbage instruction obfuscation, and custom RC4 string encryption round out its evasion toolkit.

Conclusion

TELEPUZ gives attackers deep access to infected devices. Its combination of RAT control, credential stealing, and web injection means operators can monitor victims, harvest account credentials, intercept banking activity, and deploy additional payloads at any time.

The malware's resilient command-and-control infrastructure, broad evasion capabilities, and active development make it a serious threat. Victims risk identity theft, financial fraud, account hijacking, and further malware infections. TELEPUZ should be removed from any infected system immediately.

More examples of malware classified as a RAT are Starland, DenoRAT, and MODBEACON.

How did TELEPUZ infiltrate my computer?

Based on research by Elastic Security Labs, TELEPUZ is distributed through a multi-stage ClickFix chain. Victims visit a compromised or attacker-built website displaying a fake error or verification page. That page instructs the user to open the Run dialog, paste a PowerShell command pre-loaded onto the clipboard, and execute it.

Running the command contacts an attacker-controlled server and downloads a Go-based VIDAR stealer variant as a first-stage loader. That loader then fetches and executes the TELEPUZ stager and its main payload DLL from compromised domains, entirely in memory. The victim sees no installer or warning at any point in the process.

Beyond ClickFix, threats of this kind are also spread through phishing emails, fake software download pages, pirated content, and software cracks. Staying away from unofficial download sources and being alert to unexpected prompts significantly lowers the risk of infection.

How to avoid installation of malware?

Be wary of any web page or message that asks you to open PowerShell, the Run dialog, or a command prompt and paste in a command. Legitimate services and software installers will never ask you to do this. Download programs only from official developer websites and trusted app stores, and avoid pirated content, key generators, and unofficial activation tools.

Keep your operating system and all installed programs updated to patch known security vulnerabilities. Avoid clicking ads and pop-ups on unfamiliar sites, and decline browser notification requests from pages you do not recognize. Use a reputable security solution and run regular scans. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Fake CAPTCHA page used to deliver TELEPUZ (source: elastic.co):

TELEPUZ infection chain (source: elastic.co):

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is TELEPUZ?
• STEP 1. Manual removal of TELEPUZ malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with TELEPUZ malware, should I format my storage device to get rid of it?

Formatting the storage device will remove TELEPUZ but will also erase every file on the drive. Running a reputable security tool like Combo Cleaner is usually the safer first step and avoids permanent data loss.

What are the biggest issues that TELEPUZ malware can cause?

TELEPUZ can give attackers complete remote control of an infected device, steal browser credentials and session cookies, intercept banking activity through web injection, and record keystrokes. This can result in account takeover, identity theft, unauthorized financial transactions, and additional malware installations.

What is the purpose of TELEPUZ malware?

TELEPUZ is designed to give attackers persistent remote access to infected systems. Its modular design lets operators steal credentials, monitor user activity through a keylogger, manipulate financial website pages to capture banking details, and push additional payloads as needed.

How did TELEPUZ malware infiltrate my computer?

According to Elastic Security Labs, TELEPUZ is spread through ClickFix - a technique where malicious websites trick users into pasting and running a PowerShell command. That command downloads and installs the malware without any further action required from the victim.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware, including TELEPUZ. Because this malware uses advanced evasion techniques, running a full system scan is recommended to make sure the infection is fully cleared.