ROMULUS multi-payload ClickFix delivery platform found on six servers, delivering LegionLoader via 842 MiB padded executables
Researchers at Vedere Labs (Forescout Research) reported on October 14 that they found ROMULUS, a new multi-payload shared ClickFix delivery platform, while investigating an incident. The same malware from a separate ClickFix campaign was linked to another server tied to that incident, and that server hosted the ROMULUS panel. ROMULUS is a reusable delivery backend rather than a single hard-coded malware server. Forescout identified six servers running it, which suggests it may operate as a toolkit offered to multiple cybercriminals. The operator and any common ownership of the final malware families are unknown. The platform is separate from RomulusLoader, which Proofpoint identified earlier in 2026.
Detalhes técnicos
- ClickFix uses social engineering to trick the user into running attacker-supplied commands on their own machine. Because the trusted user runs the commands, the action often bypasses security protections.
- ROMULUS supports a range of delivery routes for different malware types.
- One route distributes LegionLoader through encrypted archives. These contain an executable artificially inflated to about 842 MiB, which may exceed the file-size limits of security scanning and analysis tools.
- Researchers assess that ClickFix is evolving from a simple social engineering technique into an entry point for broader malware operations, with attackers diversifying delivery infrastructure and disguising activity.
Remediação
The article gives no specific remediation guidance or IOCs.
Linha do tempo
-
ROMULUS multi-payload ClickFix delivery platform found on six servers, delivering LegionLoader via 842 MiB padded executables
ler a análise desta fonte ocultar
Researchers at Vedere Labs (Forescout Research) reported on October 14 that they found ROMULUS, a new multi-payload shared ClickFix delivery platform, while investigating an incident. The same malware from a separate ClickFix campaign was linked to another server tied to that incident, and that server hosted the ROMULUS panel. ROMULUS is a reusable delivery backend rather than a single hard-coded malware server. Forescout identified six servers running it, which suggests it may operate as a toolkit offered to multiple cybercriminals. The operator and any common ownership of the final malware families are unknown. The platform is separate from RomulusLoader, which Proofpoint identified earlier in 2026.
Technical Details
- ClickFix uses social engineering to trick the user into running attacker-supplied commands on their own machine. Because the trusted user runs the commands, the action often bypasses security protections.
- ROMULUS supports a range of delivery routes for different malware types.
- One route distributes LegionLoader through encrypted archives. These contain an executable artificially inflated to about 842 MiB, which may exceed the file-size limits of security scanning and analysis tools.
- Researchers assess that ClickFix is evolving from a simple social engineering technique into an entry point for broader malware operations, with attackers diversifying delivery infrastructure and disguising activity.
Remediation
The article gives no specific remediation guidance or IOCs.