Researchers at Forescout's Vedere Labs have published details on a ClickFix delivery platform dubbed ROMULUS, which is being used to push malware including Legion Loader. The platform relies on ClickFix-style lures hosted on fake landing pages, coaxing users into running malicious commands that infect their own systems.

In an analysis, researcher Sai Molige said ROMULUS could be a privately run panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Forescout identified six IP addresses running the platform: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118 and 2.27.248[.]127.

The address 96.62.224[.]81 was previously linked to a ClickFix script and an MSI installer in a separate campaign that abused malicious ChatGPT Custom GPTs to send victims to a fake URL serving the lure. Forescout later found the same malware delivered through 86.109.75[.]7, which also hosted a ROMULUS panel. A separate ClickFix-triggered chain runs a PowerShell script that delivers Legion Loader, also known as Satacom downloader, CurlyGate and RobotDropper.

Who operates ROMULUS remains unknown. It shows no overlap with RomulusLoader, a malware family tied to Silver Fox (TA4922), a China-aligned actor known for tax-themed lures distributing remote access trojans such as ValleyRAT and DcRAT, and potentially Venom RAT, via DLL sideloading.

ROMULUS exposes two endpoints that download a PowerShell staging script, which then chooses the next payload: a trojanized MSI installer carrying a malware loader, or an encrypted archive containing Legion Loader. The loader contacts a remote server to fetch and run further payloads. The findings show ClickFix moving from a social engineering trick to an effective malware entry point. Mitigation advice includes hunting for suspicious PowerShell commands and DLL sideloading events.

Source: The Hackers News