ROMULUS ClickFix platform delivers Legion Loader and other malware
Forescout found six servers; PowerShell staging fetches a trojanized MSI or an archive containing Legion Loader.
68
Malware
Satacom
- Mentions · 7d0
- Mentions · 30d2
- All mentions2
- First seenOct 17, 2026
- Last mentioned10d ago
Timeline
2 articles · newest firstNew ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
62
Appears with
- ROMULUSmalware · 2
- Forescoutorganization · 2
- ChatGPTproduct · 2
- AhnLaborganization · 1
- Malpediaorganization · 1
- Microsoftvendor · 1
- Stardockvendor · 1
- LegionLoadermalware · 1
- IconEdit2Turbproduct · 1
- PowerShellproduct · 1
- Huntressorganization · 1
- OpenAIvendor · 1
- Legion Loadermalware · 1
- RobotDroppermalware · 1
- CurlyGatemalware · 1
- Stardockorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.