Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives.

The platform supports separate infection paths, including one that installs LegionLoader and another that abuses a legitimate Stardock program to load malicious code.

The findings show how a single delivery system can serve different malware packages while hiding activity behind trusted tools.

ClickFix tricks people into running commands themselves, often through fake verification prompts or repair instructions, turning an ordinary browser visit into the start of a Windows infection.

Researchers from Forescout’s Vedere Labs identified ROMULUS while investigating an independent incident and published their analysis on October 15, 2026.

They found six IP addresses exposing the same login panel and examined two delivery chains. The operators remain unknown, and researchers found no evidence linking this platform to the separately reported RomulusLoader.

Hackers Use New ROMULUS ClickFix Platform

The investigation connected the platform to a package previously described by Huntress in a campaign abusing ChatGPT Custom GPTs. That earlier activity used AI pages to direct visitors toward ClickFix traps.

Coverage of malicious ChatGPT Custom GPTs explains how trusted service pages became entry points for malware installation. ROMULUS appears to function as a reusable delivery backend rather than a server built for one payload.

Its routes use twelve-character tokens to fetch either PowerShell staging scripts or malicious MSI installers. Researchers could not confirm whether those tokens identify victims, campaigns, assignments, or delivery jobs.

One exposed statistics page tracked unique installs, total runs, a fourteen-day history, and countries. These features could help operators measure campaign performance.

However, the evidence does not establish whether ROMULUS is a private tool, a paid criminal service, an affiliate system, or software shared between different groups.

Both recovered scripts used the same basic design, rebuilding concealed code from large arrays of numbers before running it through PowerShell. Each script also removed itself before exiting.

Changing keys and variable names gave individual samples different appearances while preserving the same overall execution pattern.

The first route downloaded an MSI through an IP address written as one decimal number rather than familiar dotted notation. It saved the installer in the temporary folder, removed its downloaded-file restriction, and launched Windows Installer silently.

Similar ClickFix MSI installation attacks show why defenders should examine the full process chain instead of trusting an installer alone. The package posed as Stardock Smart DeElevation Tool and launched a genuine executable after installation.

That program loaded a patched DLL from its own folder, which then pulled in the malicious loader. This DLL sideloading chain let attackers use legitimate software as the starting point for harmful execution.

The second route hid its PowerShell window and downloaded an encrypted archive alongside the legitimate 7-Zip command-line utility.

One password-protected archive contained another, whose password came from an accompanying text file. Encrypted archive headers concealed filenames and contents from scanners lacking the password.

The extracted executable measured 882,716,672 bytes, but most of that size came from repeated padding in its relocation section.

An archive smaller than one megabyte could therefore expand into a file large enough to exceed some upload limits, sandbox budgets, or scanning thresholds. This was an evasion method, not proof that every security product failed.

Two unpacking stages used AES encryption and reversed decrypted bytes before loading LegionLoader into memory. Earlier reporting on other LegionLoader delivery chains documents its use beyond ROMULUS, but does not establish shared operators. Researchers also found five binary files whose purpose remained unclear.

LegionLoader registered infected systems, received commands, supported PowerShell execution, and handled additional payload downloads.

It also accessed Chrome Local State key material to collect sensitive browser information. Its command traffic used RC4 encryption and Base64 encoding inside requests labeled as ordinary web forms.

Forescout recommends checking PowerShell script logs, silent MSI installs from temporary folders, unusual DLL loads, and oversized executables.

With suitable network visibility, defenders can hunt for form requests containing one Base64 blob instead of normal fields. Related Forescout ClickFix loader research reinforces the value of connecting browser activity, script execution, and later network traffic rather than treating each event separately.

Users should close verification pages that demand command execution. Security teams should also review files skipped because of size limits. The source indicators below support investigation, while the earlier stager’s direct ROMULUS connection remains unconfirmed. No single indicator should replace review of the surrounding process, file, and network evidence together.

Indicators of compromise (IoCs):-

Network and Delivery Indicators

Type	Indicator	Source context
IP address	96.62.224[.]81	Huntress-documented ClickFix delivery node; ROMULUS frontend observed
Decimal IP	1614733393	Decimal representation of the Huntress delivery node
IP address	86.109.75[.]7	ROMULUS node serving both analyzed delivery chains
Decimal IP	1450003207	Decimal representation used for the analyzed ROMULUS node
IP address	151.240.151[.]223	Additional ROMULUS host; not individually analyzed
IP address	23.94.145[.]224	Additional ROMULUS host; not individually analyzed
IP address	93.152.224[.]118	Additional ROMULUS host; not individually analyzed
IP address	2.27.248[.]127	Additional ROMULUS host; not individually analyzed
Staging URL	hxxp://86.109.75[.]7/s/19481b28bd67	PowerShell route for the Stardock package
MSI URL	hxxp://86.109.75[.]7/app/19481b28bd67/IconEdit2Turb.msi	Trojanized Stardock installer
Decimal-IP URL	hxxp://1450003207/app/19481b28bd67/IconEdit2Turb.msi	Installer URL used by the staging script
Staging URL	hxxp://86.109.75[.]7/s/6c67e0336a7b	PowerShell route leading to LegionLoader
Delivery domain	orbitflownetwork[.]lol	Hosts the encrypted archive
Archive path	/dl/J8QkZUVJgV.7z	Archive location on the delivery domain
C2 domain	smashshape[.]com	LegionLoader command-and-control server
C2 endpoint	/nfront.php	Registration and command retrieval
C2 endpoint	/nback.php	Results reporting
Earlier stager	novatrafficcore[.]lol/AsFJfTQYDTkpOg6K	Direct ROMULUS connection unconfirmed
Additional MSI route	/app/60f9f0dbd64c/FreePhotoSlideShowDesktop_signed.msi	Observed on the analyzed node; payload not analyzed
Additional MSI route	/app/40152518488f/235235.msi	Observed on the analyzed node; payload not analyzed
Additional MSI route	/app/2c56afb54013/overlay.msi	Observed on the analyzed node; payload not analyzed
Earlier staging path	/s/50d6565cf39e	Route referenced in the earlier Huntress chain
Panel artifacts	/login, /api/login, /stats.htm	Login, authentication, and exposed statistics paths

SHA-256 File Hashes

All hashes below are SHA-256 values reported in Forescout’s analysis, including two helper-module hashes listed in its component table. The legitimate host executable is included for package correlation, not as proof that the file itself is malicious.

File or stage	SHA-256
IconEdit2Turb.msi	91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2
DeElevate64.exe — legitimate host	22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4
DeElevator64.dll — patched DLL	0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f
I++u.dll — malicious loader	3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621
senddmp.resources.dll — helper module	b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4
res.dll — helper module	a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6
Build.dat — loader container	d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e
execute_engine_disconnect.raw	d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90
Route A staging script	6147d56b5e35d6435d83adb49908c40a97520a0c3379121104816e37cbd1df28
Route B staging script	62ca523863337ac5d6b1c4d9ae262d1b2eb7dd9ca764b702ef719c84b2437a39
J8QkZUVJgV.7z	3b074d6f9bc399fbb1362aeb6ffe1e02013f10e8fa095fc2b3381d8cec270435
CarJqRHyOtBu3mI.7z	4e2955f5f5861a51c07fe386d782a3872cfe1c9e750295daa94626f2bd97d84a
Inflated executable carrier	1f403ac059f172e99968ce96bd0ef1bd1981070b454e3e5d75a71368c3c8762a
Stage 2 shellcode	4e0941d243c0b16e9019e4f9c5eb0f6e6630af4d44d9677611917450bb2e696e
Stage 3 LegionLoader executable	2e3d378d6a842af2404dfcd1dcbfc0df84b01b799b2c8270ddbfe5eb18837762

Supporting Archive Artifacts

These passwords are analysis artifacts from the source, rather than standalone evidence of compromise.

Archive	Reported password	Password location
J8QkZUVJgV.7z	iQQaQ7Yo41rbZ	Hardcoded in the staging script
CarJqRHyOtBu3mI.7z	RkfZvXZt6XtfuoZsHfSr	Text file extracted from the outer archive

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.