← BACK TO FEED
ClickFixmalware deliveryLegionLoaderPowerShellthreat intelligence

ROMULUS: The ClickFix-as-a-Service Platform Nobody Asked For

Cybersecurity researchers have identified a malware delivery platform called ROMULUS that uses ClickFix-style lures on fake landing pages to trick users into running malicious commands, ultimately delivering malware such as LegionLoader. The platform, discovered by Forescout Research, operates across six identified IP addresses and employs PowerShell scripts to deploy either trojanized MSI installers or encrypted malware archives inflated to nearly 1GB to evade detection. The findings highlight how ClickFix is evolving from a simple social engineering trick into a sophisticated malware delivery framework, with researchers recommending monitoring for suspicious PowerShell commands and DLL sideloading activity.

Researchers at Forescout's Vedere Labs have pulled back the curtain on a malware delivery platform called ROMULUS, which uses ClickFix-style trickery to get victims to run malicious commands on their own machines. Yes, the social engineering approach where the user does the attacker's dirty work for them.

ClickFix, for the uninitiated, involves fake error pages or landing sites that instruct users to paste commands into their terminal or Run dialog to 'fix' a problem that doesn't exist. ROMULUS appears to be an organised infrastructure built around this technique, complete with a backend panel and multiple active servers.

Forescout identified six IP addresses running the platform. One of them, 96.62.224[.]81, had already surfaced in a separate campaign that weaponised fake ChatGPT Custom GPTs to funnel victims toward ClickFix lure pages. The same malware was then spotted being served from a second server, 86.109.75[.]7, which hosted the ROMULUS panel itself. So the researchers connected the dots.

The platform works in two stages. First, a PowerShell staging script gets downloaded. Then, depending on what ROMULUS decides to serve next, the victim either receives a trojanised MSI installer or an encrypted archive containing Legion Loader, a payload also known by the names Satacom, CurlyGate, and RobotDropper. That archive is deliberately bloated to nearly 1 GB with meaningless padding, a trick designed to choke sandboxes, frustrate static analysis tools, and sidestep upload size limits.

Legion Loader then phones home to fetch further payloads. What those are depends on whoever is operating ROMULUS at any given time.

What exactly ROMULUS is remains unclear. It could be a private tool, a commercial service sold to other criminals, or an affiliate framework. Forescout floats all of these possibilities without being able to confirm one. Attribution is similarly murky, though there is no apparent connection to RomulusLoader, the malware associated with China-linked threat actor Silver Fox, despite the name overlap.

The broader takeaway is fairly straightforward: ClickFix has matured from a clever phishing trick into a structured delivery mechanism with dedicated infrastructure behind it. Defenders should be hunting for suspicious PowerShell invocations and DLL sideloading activity. If users are being prompted to paste commands anywhere they shouldn't be, that's not a bug. That's the product.

READ NEXT
TerminalFix: The ClickFix Variant That Hands Attackers Your Entire NetworkClickFix Is Everywhere Now, and It's Not Going AwayAI Is Handing Budget Hackers Nation-State Firepower, Google Reports