Cybersecurity researchers have uncovered a sophisticated new malware distribution platform known as ROMULUS, shedding light on how malicious actors are increasingly turning to advanced "ClickFix" tactics to trick users into infecting their own machines.
Identified and detailed by Forescout Research’s Vedere Labs, ROMULUS operates as an automated malware delivery service. It relies on deceitful landing pages featuring ClickFix-style lures, manipulating unsuspecting users into executing malicious commands directly within their environments. Security researcher Sai Molige noted in a recent analysis that the platform could represent a privately operated control panel, a commercial cybercriminal delivery service, an affiliate-driven framework, or software that has been independently copied and deployed across various malicious operator groups.
The investigation into ROMULUS began when researchers identified a cluster of IP addresses actively running the platform’s infrastructure. Among the infrastructure discovered by Forescout, a specific IP address—96.62.224[.]81—was found to be hosting both a ClickFix script and a malicious Microsoft Installer (MSI) file. This particular server was tied to a separate, broader campaign that has been actively abusing ChatGPT Custom GPTs. In those attacks, threat actors directed victims to fake URLs explicitly designed to serve the ClickFix lure, seamlessly bridging the gap between artificial intelligence platforms and browser-based exploitation.
Forescout’s ongoing tracking soon uncovered the same malware infrastructure operating via another server, 86.109.75[.]7, which similarly hosted the ROMULUS control panel. Further analysis of the attack chains revealed that these setups often trigger a PowerShell script designed to download and execute Legion Loader. Also recognized by alternative monikers such as Satacom downloader, CurlyGate, and RobotDropper, Legion Loader serves as an entry point for subsequent malicious payloads.
While the exact identities behind the ROMULUS platform remain shrouded in mystery, researchers have confirmed an important distinction regarding its nomenclature. Despite sharing a similar name, ROMULUS bears no technical or operational overlaps with RomulusLoader, a distinct malware family historically linked to Silver Fox, also tracked as TA4922. Silver Fox is a China-aligned threat actor notorious for repeatedly leveraging tax-related pretexts and fake software installers to distribute powerful remote access trojans and backdoors, including ValleyRAT, also known as Winos 4.0, DcRAT, and potentially Venom RAT, frequently utilizing advanced techniques like DLL sideloading.
The operational architecture of the ROMULUS platform is specifically engineered to evade detection and streamline deployment. The panel exposes two primary endpoints designed to initiate a PowerShell staging script. This script acts as an intelligent decision-maker, determining which payload should be fetched next based on the victim’s environment. The options include a trojanized MSI installer carrying an underlying malware loader or an encrypted archive containing Legion Loader. Notably, these archives are often heavily padded with repetitive data to inflate their file sizes to nearly one gigabyte. This artificial inflation is a deliberate evasion technique intended to bypass standard upload limits, consume sandbox analysis budgets, and exceed static-analysis thresholds used by security solutions. Once successfully executed, the loader establishes communication with a remote command-and-control server to fetch, decrypt, and run additional malicious payloads.
The emergence of platforms like ROMULUS highlights the continuous evolution of social engineering in the cybercrime landscape. ClickFix is no longer just a basic browser-based trick; it has matured into a sophisticated, multi-payload delivery ecosystem capable of integrating with emerging technologies like generative AI tools to maximize its reach. Security experts emphasize that mitigating threats of this nature requires organizations to maintain heightened visibility over endpoint activity. Specifically, defenders are advised to aggressively hunt for suspicious PowerShell execution patterns, anomalous staging scripts, and unauthorized DLL sideloading events before payloads can establish a permanent foothold on enterprise networks.
