8 casos · pág. 1/1
Researchers at Vedere Labs (Forescout Research) reported on October 14 that they found ROMULUS, a new multi-payload shared ClickFix delivery platform, while investigating an incident. The same malware from a separate ClickFix campaign was linked to another server tied to that incident, and that server hosted the ROMULUS panel. ROMULUS is …
Episode 485 of the Smashing Security podcast, hosted by Graham Cluley with guest Lianne Potter, covers several security stories. Researchers who wanted to test LG smart TVs for security risks got around the terms and conditions by setting up the TV while drunk, on the reasoning that they could not be bound by a contract agreed to while in…
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). For…
Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication i…
Campaigns that impersonate popular AI brands, notably Claude and ChatGPT, are on the rise. They typically use ClickFix-like social engineering tactics to target unsuspecting enterprise employees, with developers described as being at particular risk. The article, available only as a short excerpt, gives no details on payloads, infrastruct…
Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activ…
Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hosting panel identified by Forescout researchers on October 14 that…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
