New MaaS malware using a Polygon blockchain smart contract as both a C2 fallback and a kill switch. If the smart contract returns fewer than 10 bytes, the malware self-terminates. TELEPUZ is a modular malware spreading via ClickFix social engineering through VIDAR. Lightweight, hand-written C, actively developed since April 2026. Indirect syscalls patched as trampoline stubs into random legitimate DLLs at runtime. NTDLL unhooking from a fresh mapped copy. AMSI and ETW patched out. DLL notification callbacks stripped. Anti-VM, anti-debug, and CIS country exclusion. Fallback C2 resolution through four independent channels: Telegram, Steam profile names, DNS records, and Polygon blockchain. WebSocket C2 with TLS. 36 commands. Process hollowing. Token theft. UAC bypass via COM elevation moniker and AppInfo ALPC with DebugObjects. Modular stealer, keylogger, web injector using Chrome DevTools Protocol without ever injecting into the browser. Shellcode injection command still returns "INJECT:TODO" confirming active development. Full IOCs and YARA rules included. elastic.co/security-labs/tel… Author: @elasticseclabs #MalwareAnalysis #ThreatIntel #InfoSec