- Published on
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
- Authors
- Name
- DeepHorus
Cybersecurity researchers at Forescout Research - Vedere Labs have disclosed a ClickFix delivery platform called ROMULUS that is being used to distribute Legion Loader and other malware. The platform employs bogus landing pages with ClickFix-style lures to trick unsuspecting users into running malicious commands and infecting their own machines. Forescout security researcher Sai Molige said ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. The disclosure highlights how ClickFix techniques are being industrialized for malware delivery.
Forescout identified six IP addresses running ROMULUS, including 96.62.224[.]81 and 86.109.75[.]7. The address 96.62.224[.]81 was previously linked to a campaign that leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL serving a ClickFix lure. Researchers found the same malware delivered via 86.109.75[.]7, which also hosted a ROMULUS panel. ClickFix continues to evolve from a social engineering trick into a repeatable malware entry point.
The ROMULUS platform exposes two endpoints designed to download a PowerShell staging script that decides the next payload. One option is a trojanized MSI installer carrying a malware loader; the other is an encrypted archive containing Legion Loader inflated to nearly 1 GB with repetitive padding. A separate ClickFix chain runs a PowerShell script that delivers Legion Loader, also known as Satacom downloader, CurlyGate, and RobotDropper. The loader communicates with a remote server to fetch and run additional payloads.
The padding is intended to bypass upload limits, sandbox budgets, or static-analysis thresholds. This evasion tactic makes analysis harder and allows the encrypted archive to evade simple scrutiny. The findings matter because ClickFix lures rely on user execution, turning victims into unwitting infection vectors. ROMULUS therefore lowers the barrier for distributing loaders such as Legion Loader.
As of writing, it is unknown who is behind the ROMULUS platform. It shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922), a China-aligned threat actor known for tax-related pretexts to distribute ValleyRAT, DcRAT, and potentially Venom RAT via DLL sideloading. That distinction is important because the similar names could otherwise confuse attribution.
To mitigate the threat, Forescout said it is essential to hunt for suspicious PowerShell commands and DLL sideloading events. Organizations should also scrutinize ClickFix-style lures that instruct users to paste commands into run dialogs. The platform's operational model remains unclear, but its use of legitimate-looking installers and oversized encrypted archives signals continued evasion. Further tracking of ROMULUS infrastructure will be needed to assess its reach.
