Researchers Expose ROMULUS Platform Using ClickFix to Distribute LegionLoader
Forescout analysis reveals a new malware delivery service leveraging ClickFix lures on fake pages to install loaders on unsuspecting users' machines.
Key points
- ROMULUS is a ClickFix delivery platform distributing Legion Loader and other malware via deceptive landing pages.
- The service uses PowerShell scripts and trojanized MSI installers to fetch payloads from remote servers.
- Researchers found no link between ROMULUS and the China-aligned RomulusLoader malware family.
Cybersecurity researchers at Forescout Research - Vedere Labs have disclosed details of ROMULUS, a new malware delivery platform that exploits ClickFix-style social engineering to distribute Legion Loader and other malicious software. This finding expands the known threat landscape of user-triggered attacks, building on earlier reporting by Threat Times regarding the exploitation of Siemens Software Center flaws in Romulus campaigns.
The ROMULUS platform operates as a service that hosts bogus landing pages designed to trick users into executing malicious commands on their own devices. Security researcher Sai Molige noted that the infrastructure may represent a privately operated panel, a commercial cybercriminal service, an affiliate framework, or software copied between different operators. As of the report, the specific identities behind the ROMULUS platform remain unknown to investigators.
Technical Mechanics and Infrastructure
Forescout analysts identified six IP addresses associated with the ROMULUS infrastructure during their investigation. One notable address, 96.62.224[.]81, hosted both a ClickFix script and an MSI installer file. This server was linked to a separate campaign that used malicious ChatGPT Custom GPTs to direct victims toward the fake URL serving the ClickFix lure, demonstrating the evolving integration of AI interfaces in attack chains.
Another server, 86.109.75[.]7, also hosted a panel codenamed ROMULUS and delivered the same malware. The platform exposes two primary endpoints designed to download a PowerShell staging script. This script determines the next payload, which is either a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader.
Legion Loader, also known as Satacom downloader, CurlyGate, and RobotDropper, communicates with remote servers to fetch and execute additional payloads. The findings highlight how ClickFix is evolving from a simple social engineering technique into a highly effective entry point for complex malware delivery. Researchers recommend hunting for suspicious PowerShell commands and DLL sideloading events to mitigate these threats.
Distinction from Known Threat Actors
Investigators confirmed that the ROMULUS platform shares no overlaps with RomulusLoader, a distinct malware family. RomulusLoader is associated with Silver Fox, also known as TA4922, a China-aligned threat actor. That group is known for using tax-related pretexts to distribute remote access trojans such as ValleyRAT, DcRAT, and potentially Venom RAT via DLL sideloading techniques. The lack of connection suggests ROMULUS is an independent operation.
What should you do?
Organizations should monitor for unusual PowerShell activity and unexpected MSI installations that may indicate ClickFix exploitation. Security teams should also inspect DNS queries and HTTP traffic for connections to known malicious IPs associated with these delivery platforms. Users should be trained to recognize bogus landing pages and avoid running commands prompted by unsolicited links, particularly those originating from AI chat interfaces.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: ROMULUS
- Monitor endpoint logs for unexpected PowerShell script executions that may indicate staging activities.
- Inspect network traffic for connections to newly identified IPs hosting ClickFix lures or ROMULUS panels.
- Verify the legitimacy of MSI installers and check for DLL sideloading attempts in application directories.
- Educate users on recognizing fake landing pages and the risks of running commands from untrusted sources.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is ROMULUS?
ROMULUS is a malware delivery platform that uses ClickFix-style lures on fake landing pages to trick users into running malicious commands.
Is ROMULUS linked to the China-aligned threat actor Silver Fox?
No, researchers found no overlaps between the ROMULUS platform and RomulusLoader, which is associated with Silver Fox (TA4922).
How does the ROMULUS platform deliver malware?
It uses endpoints to download PowerShell staging scripts that fetch trojanized MSI installers or encrypted archives containing Legion Loader.
