ROMULUS ClickFix platform delivers Legion Loader and other malware
Forescout found six servers; PowerShell staging fetches a trojanized MSI or an archive containing Legion Loader.
Stories per day · 30 days
3 RSS
Relatedclickfix3romulus3forescout2legionloader2powershell2dll-sideloading1legion-loader1social-engineering1
9 stories, newest first · one card per story
Stories tagged #malware-delivery
Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.
Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns
Black Hills monitoring ties four ClickFix malware delivery chains to bulletproof host AS202412 (OMEGATECH LTD), making ASN-level blocking the durable defense.
2
ClickFix attacks infecting PCs and Macs are going viral
ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.
2
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
13
Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines
A ClickFix social engineering wave delivers a multi-stage attack that hides malware in PNG files and installs a custom reverse tunnel.
1
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
Huntress explains how threat actors abuse trusted AI platforms as an attack surface for malware delivery and data theft.
1
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
Lazarus used a post-quantum key exchange to shield delivery of a Windows zero-day exploit, adding stealth to its campaign.