ROMULUS Platform Turns ClickFix Into a Malware Delivery Pipeline

Researchers at Forescout Research — Vedere Labs have disclosed details of a platform called ROMULUS that attackers use to spread malware, including the Legion Loader.

According to the analysis, ROMULUS operates much like a malware delivery service: fake landing pages deploy ClickFix-style lures that trick careless users into running a malicious command by hand, infecting their own machines. What ROMULUS actually is remains unclear — it could be a privately run control panel, a commercial cybercriminal delivery service, an affiliate framework, or simply software copied between operators.

Six servers and the infection chain

Forescout identified six IP addresses running ROMULUS. One of them, 96.62.224[.]81, had already surfaced in another campaign that served ClickFix lures via malicious custom GPTs on ChatGPT, steering victims to a fake URL. The same payload and a panel codenamed ROMULUS turned up on a second server. A separate ClickFix-triggered chain launches a PowerShell script that delivers Legion Loader — also known as the Satacom downloader, CurlyGate, and RobotDropper.

The platform exposes two endpoints that download a staging PowerShell script, which decides what to fetch next: a trojanized MSI installer carrying a loader, or an encrypted archive holding Legion Loader. A curious detail — the archive is artificially inflated to nearly 1 GB with repetitive padding, a trick to slip past upload limits, sandbox budgets, and static-analysis thresholds. The loader then contacts a remote server to pull down further payloads.

Not to be confused with RomulusLoader

Who is behind ROMULUS is unknown. The researchers stress that the platform shares no overlap with RomulusLoader, a malware family tied to the China-aligned actor Silver Fox (aka TA4922), which is known for using tax-themed pretexts to distribute remote access trojans.

Forescout's takeaway: ClickFix is evolving from a mere social engineering technique into a highly effective entry point for malware. To counter it, defenders should hunt for suspicious PowerShell commands and DLL sideloading events.

Source: The Hacker News