Cybersecurity researchers have uncovered a sophisticated shift in how threat actors are deploying "ClickFix" tactics, revealing the emergence of a centralized, scalable ecosystem designed to distribute a wide array of malware. The discovery, detailed in a report published on October 14 by analysts at Vedere Labs, a division of Forescout Research, suggests that ClickFix—once considered a bespoke social engineering technique—has been industrialized into a reusable delivery platform.
The investigation began when researchers were analyzing a recent security incident. While tracing the origins of the attack, they identified a server hosting a previously undocumented management panel dubbed "ROMULUS." Further forensic analysis revealed that the malicious payloads associated with this incident were identical to those delivered by separate, seemingly unrelated ClickFix campaigns. The discovery of the ROMULUS panel provided the "smoking gun," linking these disparate operations to a shared, multi-payload delivery architecture.
The Evolution of ClickFix Tactics
ClickFix has long been recognized as a highly effective, if somewhat manual, attack vector. At its core, the technique relies entirely on psychological manipulation. Rather than exploiting a technical vulnerability in software or hardware, ClickFix tricks the user into becoming an unwitting accomplice in their own compromise.
The typical ClickFix workflow involves presenting the victim with a fake error message—often disguised as a browser or system alert—prompting them to resolve an issue by copying and pasting a command into their terminal, such as PowerShell or the Command Prompt. Because these commands are executed by the legitimate, authenticated user of the machine, the action often bypasses traditional security controls. Most endpoint detection and response (EDR) systems or antivirus solutions are configured to block unauthorized external processes; however, they are frequently tuned to allow actions initiated by the user, especially when those actions appear to be legitimate administrative commands.
By leveraging the user’s own authority, attackers can bypass security barriers that would otherwise stop a more conventional malware injection. Until recently, these campaigns were often viewed as one-off operations, requiring significant manual effort to set up and maintain. The discovery of the ROMULUS platform, however, indicates that this dynamic is shifting toward a more automated, "as-a-service" model.
ROMULUS: A Scalable Malware Delivery Ecosystem
The ROMULUS platform represents a significant departure from the fragmented nature of previous ClickFix operations. According to the Forescout researchers, ROMULUS functions as a multi-payload shared delivery platform, allowing threat actors to swap out malicious payloads depending on the target or the objective of the campaign.
Instead of being a static, hard-coded server, ROMULUS serves as a flexible backend infrastructure. This architecture allows it to be used at scale, providing a "malware-as-a-service" utility that can be utilized by multiple different cybercriminal groups. Forescout analysts have already identified at least six separate servers running the ROMULUS interface, a high number for such a specialized tool. This suggests that the infrastructure is not limited to a single threat actor, but is likely being leased or shared among a broader network of criminals looking to streamline their attack delivery.
The operational flexibility of ROMULUS allows attackers to target different demographics and environments simultaneously. By maintaining a centralized control panel, the operators behind ROMULUS can manage various campaigns from a single location, updating payloads, modifying social engineering lures, and tracking the success rates of their infections in real time.
Evasion Techniques and Infrastructure Diversification
Beyond the organizational improvements brought by the ROMULUS platform, researchers have observed a marked increase in the technical sophistication used to hide these campaigns. In one documented delivery route, the platform was used to distribute LegionLoader, a versatile, multi-pronged malware delivery tool.
To avoid detection by automated security scanning tools, the attackers employed an ingenious obfuscation technique: they bundled the malicious executable within encrypted archives that were artificially inflated to approximately 842 MiB. This massive file size is designed to exceed the threshold of many security appliances and cloud-based analysis tools. Many sandbox environments and automated malware scanners have a file-size limit for inspection to maintain system performance; by bloating the archive to nearly a gigabyte, the attackers effectively hide their payload in plain sight, knowing that many security scanners will simply skip the file rather than process it.
This level of effort highlights a broader trend: as security defenses become more robust, attackers are increasingly diversifying their infrastructure to ensure their malicious content reaches the endpoint. By combining the psychological trickery of ClickFix with the technical evasion capabilities of the ROMULUS platform, threat actors are creating a highly resilient attack chain that is difficult to detect and even harder to mitigate.
The Unknown Operators and Future Outlook
Despite the depth of the research provided by Vedere Labs, the identities of the operators behind the ROMULUS platform remain a mystery. The researchers noted that while there is clear common ownership of the malicious families being distributed, the specific individuals or groups orchestrating the platform have not yet been attributed to any known cybercriminal syndicates.
Adding to the complexity of the situation is the fact that the ROMULUS platform discovered by Forescout is entirely separate from "RomulusLoader," a different strain of malware that was identified by Proofpoint researchers earlier in 2026. The naming coincidence has caused some confusion in the cybersecurity community, but investigators are clear that the two are distinct threats.
The emergence of ROMULUS serves as a sobering reminder of the agility of modern cybercrime. As defensive technologies evolve to block traditional malware delivery methods—such as malicious macros or drive-by downloads—attackers are pivoting toward tactics that leverage the human element. The industrialization of ClickFix through platforms like ROMULUS suggests that the "human-in-the-loop" attack model is gaining traction in the criminal underground.
For organizations, the rise of such platforms highlights the necessity of not only technical defenses but also rigorous security awareness training. While EDR and managed detection services are critical, they cannot always identify a threat when a legitimate user is performing the malicious action. Organizations must focus on hardening their environments against the abuse of administrative tools like PowerShell and ensuring that users are trained to recognize the signs of social engineering—even when those signs appear as "helpful" system prompts.
As the digital landscape continues to change, the professional security community remains focused on dismantling the infrastructure that supports these campaigns. With the discovery of these six ROMULUS servers, researchers have gained a vital window into the mechanics of a new generation of malware delivery, providing a roadmap for future detection and disruption efforts. For now, however, the adaptability of these platforms suggests that the threat of industrial-scale ClickFix attacks is likely to persist as a major concern for security operations centers worldwide.
