CYBERSECURITY researchers have detailed a new ClickFix-style delivery platform named ROMULUS, used to distribute malware such as Legion Loader. Forescout Research – Vedere Labs describe ROMULUS as a modular malware delivery service that lures users to bogus landing pages and tricks them into running malicious commands, enabling self-propagation on infected machines.
The platform appears to act as a private panel, a commercial delivery service, or an affiliate framework, with operators potentially copying tools between groups.
Evidence gathered includes at least six IP addresses hosting ROMULUS infrastructure: 96.62.224.[.]81, 86.109.75.[.]7, 151.240.151.[.]223, 23.94.145.[.]224, 93.152.224.[.]118, and 2.27.248.[.]127. Notably, 96.62.224.[.]81 hosted a ClickFix script and an MSI installer tied to a campaign that leverages malicious ChatGPT Custom GPTs to direct victims to the lure. A separate server at 86.109.75.[.]7 also ran a ROMULUS panel.
ROMULUS exposes two endpoints that download a PowerShell staging script to decide the next payload, which may be a trojanised MSI containing a loader or an encrypted archive with Legion Loader. The loader then contacts a remote server to fetch further payloads, indicating ROMULUS’ role as an automated distribution mechanism for multiple malware families.
Practical response emphasises hunting for suspicious PowerShell activity and DLL sideloading events, given ClickFix is evolving into a robust entry point for deploying secondary payloads. The report underscores the need for defenders to monitor for unusual PowerShell commands, analyze MSI and DLL loading chains, and investigate anomalous ROMULUS-like infrastructure traffic to curb opportunistic campaigns.