New ROMULUS ClickFix Platform Delivers Malware, Evades Detection

Key Takeaways

• A new malware delivery platform, dubbed ROMULUS, is actively distributing various malicious payloads through “ClickFix” social engineering tactics.
• ROMULUS employs sophisticated evasion techniques, including hidden PowerShell scripts, trojanized software installers, and multi-layered encrypted archives.
• The platform supports multiple infection chains, notably one that installs LegionLoader and another that leverages a legitimate Stardock application for DLL sideloading.
• Researchers from Forescout’s Vedere Labs identified ROMULUS, emphasizing the need for comprehensive security monitoring beyond isolated events.

ROMULUS Platform Emerges, Leveraging ClickFix for Malware Delivery

Cybersecurity researchers have uncovered a new, versatile platform named ROMULUS that facilitates the distribution of diverse malware through “ClickFix” social engineering schemes. This sophisticated delivery system integrates concealed PowerShell scripts, manipulated software installers, and layered encrypted archives to bypass detection and infect target systems.

The ROMULUS platform demonstrates its adaptability by supporting distinct infection pathways. One identified route deploys the LegionLoader malware, while another exploits a legitimate Stardock application to inject malicious code via DLL sideloading. This modularity highlights a growing trend among threat actors to utilize flexible delivery mechanisms capable of serving multiple malware types while masquerading behind seemingly legitimate tools.

ClickFix attacks manipulate users into executing commands themselves, typically by presenting deceptive verification prompts or system repair instructions. This tactic transforms a routine web browsing session into a critical entry point for Windows-based infections.

Discovery and Operational Insights

Researchers from Forescout’s Vedere Labs identified ROMULUS during an independent incident investigation, subsequently publishing their detailed analysis on October 15, 2026. Their investigation uncovered six IP addresses exposing an identical login panel, allowing for the examination of two primary delivery chains. The identities of the operators behind ROMULUS remain unknown, and no connection has been established between this platform and the previously reported RomulusLoader.

The investigation linked the ROMULUS platform to a malware package previously documented by Huntress, which was involved in a campaign exploiting ChatGPT Custom GPTs. This earlier activity leveraged AI-powered pages to redirect unsuspecting visitors toward ClickFix traps. The observed operational pattern suggests that ROMULUS functions as a reusable backend for malware delivery, rather than a system designed for a singular payload. Its routing mechanisms utilize twelve-character tokens to retrieve either PowerShell staging scripts or malicious MSI installers. Researchers have not yet determined whether these tokens serve to identify victims, campaigns, assignments, or specific delivery jobs.

An exposed statistics page associated with ROMULUS tracked metrics such as unique installations, total runs, a fourteen-day historical overview, and geographical distribution by country. These features indicate the platform’s capability to assist operators in monitoring and evaluating campaign effectiveness. However, current evidence does not definitively classify ROMULUS as a private tool, a commercial criminal service, an affiliate system, or a shared resource among various threat groups.

Advanced Evasion Techniques: Hidden PowerShell and DLL Sideloading

Analysis of the recovered PowerShell scripts revealed a consistent design: obfuscated code is reconstructed from extensive numerical arrays before execution. Each script also includes a self-deletion mechanism upon completion. This approach allows for variations in appearance, such as changing keys and variable names, while maintaining the same underlying execution logic.

One observed infection route involved downloading an MSI installer via an IP address represented as a single decimal number, rather than the standard dotted-decimal notation. The installer was saved to a temporary folder, its downloaded-file restriction was removed, and Windows Installer was launched silently. Such ClickFix MSI installation attacks underscore the critical need for defenders to scrutinize the entire process chain rather than relying solely on the apparent legitimacy of an installer. In this instance, the package mimicked the “Stardock Smart DeElevation Tool” and, after installation, launched a genuine executable. This legitimate program then loaded a modified DLL from its own directory, which subsequently initiated the malicious loader. This DLL sideloading technique enables attackers to leverage trusted software as a springboard for malicious execution.

The second infection route concealed its PowerShell window and downloaded an encrypted archive alongside the legitimate 7-Zip command-line utility. This setup involved a nested archive structure: one password-protected archive contained another, with the inner archive’s password stored in an accompanying text file. Encrypted archive headers effectively obscure filenames and contents from scanners that lack the necessary password.

The extracted executable from this second route measured an exceptionally large 882,716,672 bytes. However, the majority of this size was attributed to repetitive padding within its relocation section. This technique allows an archive smaller than one megabyte to expand into a file large enough to bypass certain upload limits, sandbox budgets, or scanning thresholds, serving as an evasion method rather than an indication of widespread security product failure.

The LegionLoader delivery chain involved two unpacking stages, utilizing AES encryption and reversed decrypted bytes before loading LegionLoader into memory. Prior reports on other LegionLoader delivery chains confirm its use beyond ROMULUS, though a direct link between operators has not been established. Researchers also discovered five additional binary files whose specific functions remained unconfirmed.

Once deployed, LegionLoader registered infected systems, received commands, supported PowerShell execution, and managed the download of additional payloads. It was also found to access Chrome Local State key material to exfiltrate sensitive browser information. Its command-and-control (C2) traffic employed RC4 encryption and Base64 encoding, disguised within requests masquerading as ordinary web forms.

What You Should Do

• Monitor PowerShell script logs for unusual activity, especially scripts reconstructing hidden code.
• Inspect silent MSI installations originating from temporary folders, as these often indicate suspicious activity.
• Detect and investigate unusual DLL loads, particularly those where legitimate applications load unexpected or modified DLLs.
• Implement network visibility solutions to identify form requests containing single large Base64 blobs instead of typical form fields.
• Educate users to close browser verification pages that demand immediate command execution or software installation.
• Configure security solutions to review files that are skipped due to exceeding size limits, as this is a known evasion tactic.
• Correlate browser activity, script execution, and subsequent network traffic to identify complete attack chains rather than isolated events.
• Utilize the provided Indicators of Compromise (IoCs) in your threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for proactive detection and blocking. Remember to re-fang defanged IP addresses and domains only within controlled environments.

Indicators of Compromise (IoCs)

Network and Delivery Indicators

SHA-256 File Hashes

All hashes below are SHA-256 values reported in Forescout’s analysis, including two helper-module hashes listed in its component table. The legitimate host executable is included for package correlation, not as proof that the file itself is malicious.

Supporting Archive Artifacts

These passwords are analysis artifacts from the source, rather than standalone evidence of compromise.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.