ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.
Forescout's Vedere Labs found a hosting panel called ROMULUS while investigating an incident tied to ClickFix activity. Analysts describe it as a reusable multi-payload delivery backend and identified six servers running it, suggesting shared criminal infrastructure. One route delivered LegionLoader in encrypted archives containing an executable inflated to about 842 MiB, likely to evade size-limited scanning. The operator is unknown, and ROMULUS is distinct from Proofpoint's RomulusLoader.
- Six servers were found hosting the ROMULUS ClickFix panel.
- ROMULUS is a reusable backend that can deliver multiple payloads.
- One path delivered LegionLoader in an executable padded to about 842 MiB.
- The operator and ownership of the final malware families are unknown.
- ROMULUS is separate from Proofpoint's earlier RomulusLoader.
Full article391 words · extracted from infosecurity-magazine.com · click to collapse
Cybercriminals have started to adapt campaigns that deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims, cybersecurity researchers have warned.
As detailed in a blog post published on October 14, security analysts at Vedere Labs, a part of Forescout Research, discovered the server hosting panel ROMULUS while investigating an incident.
They found that the exact same malware delivered by a separate ClickFix campaign was also connected to another server linked to the incident being investigated.
The new server was discovered to be hosting a panel called ROMULUS. Further analysis revealed this to be a new multi-payload shared ClickFix delivery platform.
ClickFix is a popular attack technique among cybercriminals. It relies on social engineering to trick the victim into running attacker-supplied commands on their own machine.
And because ClickFix relies on the real, trusted user of the machine to run the commands, action often bypasses any security protections that may be in place to stop unauthorized action.
ClickFix Able to be Deployed at Scale
The newly uncovered ROMULUS platform appears to be capable of deploying a range of attack routes to deliver different forms of malware. Researchers also note that ROMULUS is a reusable delivery backend rather than a single hard-coded malware server, suggesting it is being used at scale.
In total, Forescout analysts identified a total of six different servers running ROMULUS, something they said could indicate that this infrastructure is being run as a toolkit for a wide-range of cybercriminals to use to distribute their attacks.
ROMULUS is also notable for using an unusual method to help disguise its operations. One delivery route was observed to distribute LegionLoader, a multi-pronged malware delivery platform, through encrypted archives containing an executable artificially inflated to approximately 842 MiB, potentially exceeding file-size limits imposed by security scanning and analysis tools.
Researchers believe that this operation shows how ClickFix is evolving beyond a simple social engineering technique into an entry point for malware operations, while attackers are also diversifying their delivery infrastructure, disguising malicious activity and making threats harder to detect.
The identity of the operator behind the platform and common ownership of the final malware families are unknown. But it is noted that this ROMULUS platform is separate to RomulusLoader, a form of malware identified by researchers at Proofpoint earlier in 2026.