Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.
Forescout's Vedere Labs identified ROMULUS, a reusable backend that delivers malware through ClickFix lures using concealed PowerShell and malicious MSI installers. One chain silently installed a package posing as Stardock's Smart DeElevation Tool and used DLL sideloading; another used 7-Zip and nested encrypted archives to load LegionLoader. LegionLoader registered infected systems, executed PowerShell, fetched payloads, and accessed Chrome Local State material, with command traffic using RC4 and Base64. Researchers linked earlier activity to ChatGPT Custom GPT lures documented by Huntress but found no evidence tying ROMULUS to RomulusLoader.
64