New ROMULUS Platform Packages ClickFix Tricks to Spread Legion Loader Malware

Researchers at Forescout Research - Vedere Labs have disclosed details of ROMULUS, a platform that works like a malware delivery service. It uses ClickFix-style lures on bogus landing pages to persuade users to run malicious commands themselves, which ends up infecting their own machines. Forescout said it identified six IP addresses running ROMULUS. Researcher Sai Molige noted that it may be a privately operated panel, a commercial criminal service, an affiliate framework, or software copied between operators. Who is behind it is not yet known.

One server linked to ROMULUS was also tied to another campaign that used malicious ChatGPT Custom GPTs to send victims to a fake URL serving the ClickFix lure. Forescout later found the same malware delivered from a second server that also hosted a ROMULUS panel. In one attack chain, a ClickFix lure triggers a PowerShell script that delivers Legion Loader, a loader also known as Satacom downloader, CurlyGate and RobotDropper. The platform's PowerShell staging script decides what is fetched next: either a trojanized installer carrying a loader, or an encrypted archive containing Legion Loader, padded to nearly 1 GB to get past upload limits and analysis tools. The loader then contacts a remote server to fetch and run further payloads.

Forescout says the findings show ClickFix is evolving from a social engineering technique into a highly effective entry point for malware. Researchers recommend hunting for suspicious PowerShell commands and DLL sideloading events. ROMULUS is unrelated to RomulusLoader, a malware family linked to the threat actor Silver Fox.