ROMULUS Platform Turns ClickFix Tricks into a Reusable Malware Delivery Service

Researchers at Vedere Labs, part of Forescout Research, have warned that cybercriminals are turning ClickFix tactics into a full ecosystem that can be reused to deliver many kinds of malware. In a blog post published on October 14, the team said it found a server hosting a panel called ROMULUS while investigating an incident. The same malware seen in a separate ClickFix campaign was also linked to another server tied to that incident.

ClickFix is a popular technique that relies on social engineering. It tricks a victim into running attacker-supplied commands on their own machine. Because the real, trusted user carries out the action, it can often bypass security protections designed to stop unauthorised activity. ROMULUS is described as a reusable delivery backend rather than a single hard-coded malware server, which suggests it is being used at scale. Forescout identified six different servers running it, which could indicate the infrastructure is operated as a toolkit for a wide range of cybercriminals.

ROMULUS also uses an unusual method to hide its activity. One delivery route distributed LegionLoader, a multi-pronged malware delivery platform, through encrypted archives containing an executable inflated to roughly 842 MiB. That size may exceed the file limits of some security scanning and analysis tools. Researchers believe this shows ClickFix evolving beyond a simple trick into an entry point for wider malware operations, with attackers diversifying their infrastructure and making threats harder to detect.