Forescout Links ClickFix to ROMULUS and Lorem Ipsum

October 2026 reports describe a six-server ROMULUS ClickFix backend and a separate Lorem Ipsum loader that installed a Python tunnel before ransomware was stopped.

October 2026 coverage describes two ClickFix-related strands, not one confirmed campaign. Forescout’s Vedere Labs, cited by Infosecurity Magazine and a 16 October Cyber Security News report, identified ROMULUS as a reusable multi-payload delivery panel on six servers; one path delivered LegionLoader via encrypted archives, including an executable inflated to about 842 MiB, while the later account adds a sideload chain posing as Stardock’s Smart DeElevation Tool, 7-Zip nested archives, LegionLoader access to Chrome Local State material, RC4-and-Base64 command traffic, and a possible link to earlier ChatGPT Custom GPT lures documented by Huntress. The operator and service model remain unknown, and sources agree ROMULUS is distinct from Proofpoint’s RomulusLoader. Separately, GBHackers and Cyber Security News describe a late-September Windows intrusion in which ClickFix and TerminalFix prompts led to Lorem Ipsum Loader and a Python tunnel able to relay TCP traffic. A ZIP used a legitimate or signed Microsoft executable with a malicious DLL, registry and scheduled-task persistence, and another path used a modified Teams MSI; the loader used a dead-drop resolver—described by one source as public forum profiles—then a TLS WebSocket client. Sources agree encryption was not observed because the intrusion was contained, and they do not confirm Lorem Ipsum as Axolotl Loader: GBHackers cites infrastructure overlap with implementation differences, while Cyber Security News says Forescout compared five Lorem Ipsum samples with 39 AxolotlLoader samples and saw methods resembling Vice Society and Rhysida without confirming either group.

• Forescout’s Vedere Labs identified ROMULUS, a reusable ClickFix multi-payload backend, on six servers; the operator and service model are unknown.
• One ROMULUS path delivered LegionLoader in encrypted archives with an executable padded to about 842 MiB; a 16 October account also describes 7-Zip nested archives and in-memory loading.
• Another ROMULUS chain used a package posing as Stardock’s Smart DeElevation Tool with DLL sideloading; LegionLoader ran PowerShell, fetched payloads, and accessed Chrome Local State material, with command traffic using RC4 and Base64.
• Researchers tied earlier related lures to ChatGPT Custom GPTs documented by Huntress and found no evidence linking ROMULUS to Proofpoint’s RomulusLoader.
• A separate late-September intrusion used ClickFix and TerminalFix to install Lorem Ipsum Loader and a Python TCP tunnel over TLS and WebSocket.
• Persistence was described as a user Run key plus a scheduled task; Cyber Security News specifies an hourly task, and sources also mention a modified or trojanized Microsoft Teams MSI path.
• Ransomware was assessed as a likely objective, but encryption was not observed because the intrusion was contained.
• Lorem Ipsum is not confirmed as Axolotl Loader: GBHackers notes infrastructure overlap with implementation differences, while Forescout compared 5 Lorem Ipsum samples with 39 AxolotlLoader samples and saw unconfirmed resemblance to Vice…