Cybersecurity researchers have uncovered a newly detailed malware delivery platform known as ROMULUS, which utilizes deceptive "ClickFix" social engineering lures on rogue landing pages to trick unsuspecting users into manually executing malicious commands that ultimately infect their own computer systems.
According to findings published by Forescout Research and its Vedere Labs division, the ROMULUS platform functions much like a modular malware delivery service. By leveraging browser-based manipulation and misleading instructions, the infrastructure convinces victims that they need to troubleshoot a routine software glitch or error by copying and pasting hidden scripts into their command-line interfaces.
Security researcher Sai Molige detailed the discovery in a recent analysis, noting that the origin of the platform remains somewhat ambiguous. "ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," Molige explained, highlighting the versatile and potentially widespread nature of the threat architecture.
Forescout’s ongoing tracking of the infrastructure identified at least six active IP addresses running the ROMULUS framework. Among these, the IP address 96.62.224[.]81 was singled out for hosting both a custom ClickFix script and a malicious Microsoft Software Installer (MSI) file. This particular server was found to be connected to a broader campaign that previously leveraged malicious ChatGPT Custom GPTs to direct victims toward rogue URLs designed to present the ClickFix lure.
Further investigation by Forescout uncovered the same malicious payload being distributed through an additional server operating at 86.109.75[.]7, which similarly hosted the ROMULUS management panel. Additional tracking revealed that separate infection chains triggered via the ClickFix mechanism executed underlying PowerShell scripts to deploy Legion Loader. Legion Loader, a persistent threat known interchangeably in the cybersecurity community by aliases such as Satacom downloader, CurlyGate, and RobotDropper, acts as an initial foothold for attackers looking to establish deeper access inside target networks.
As of the current reporting, the exact threat actors behind the creation and maintenance of the ROMULUS platform remain unidentified. However, security analysts have clarified that despite the name, ROMULUS shares no technical or operational overlaps with RomulusLoader. The latter is a distinct malware family historically attributed to Silver Fox, a China-aligned advanced persistent threat group also tracked as TA4922. Silver Fox is well known in the threat intelligence community for using tax-themed pretexts and deceptive software installers to disable security tools and deploy remote access trojans like ValleyRAT, also known as Winos 4.0, along with DcRAT and potentially Venom RAT via complex DLL sideloading techniques.
The operational workflow of the ROMULUS platform relies on specific endpoints configured to drop a PowerShell staging script onto the victim’s machine. This initial staging script acts as a decision-making engine, determining which subsequent payload should be retrieved based on the environment or the parameters of the campaign. The platform is capable of deploying a trojanized MSI installer that carries a primary malware loader, or alternatively, an encrypted archive containing Legion Loader. Notably, the operators of ROMULUS artificially bloat this encrypted archive to nearly one gigabyte using repetitive padding data. Security experts note that this heavy padding is deliberately designed to evade file upload limits, bypass sandbox analysis budgets, and slip past static-analysis thresholds used by traditional security software. Once successfully deployed on a machine, the loader initiates communications with a remote command-and-control server to fetch, decrypt, and execute additional secondary payloads.
The emergence and refinement of the ROMULUS platform underscore a broader trend within modern cybercrime: the evolution of ClickFix techniques from basic social engineering tricks into highly structured, efficient entry points for multi-payload malware operations. Because these attacks rely heavily on user interaction rather than traditional vulnerability exploitation, they bypass many conventional perimeter defenses. Cybersecurity professionals recommend that organizations focus their threat hunting efforts on detecting anomalous PowerShell execution behaviors, tracking suspicious command-line activity, and monitoring for unauthorized DLL sideloading events across enterprise endpoints.
