Researchers at Forescout’s Vedere Labs have described ROMULUS, a platform that delivers malware through ClickFix lures: fake landing pages that talk visitors into copying a command and running it on their own computer. Forescout says it found six IP addresses running ROMULUS and that it behaves like a malware delivery service, though it could equally be a private panel, an affiliate framework or software copied between operators. Nobody has been identified as being behind it, and Forescout notes it shares no overlap with RomulusLoader, a malware family tied to the China-aligned group Silver Fox.
According to The Hacker News’ summary of the research, the platform exposes two endpoints that serve a PowerShell staging script, which decides what to fetch next: either a trojanized MSI installer carrying a malware loader, or an encrypted archive containing Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). Forescout’s report describes a Legion Loader executable inflated to about 842 MiB with padding, a trick to slip past upload limits, sandbox budgets and static-analysis thresholds, and that the MSI route abuses DLL side-loading. One of the servers had previously hosted a ClickFix script tied to a separate campaign that used malicious ChatGPT Custom GPTs to send victims to a fake URL. The loader then contacts a remote server to fetch further payloads. For an earlier ClickFix campaign see our 10-07 post on the Lunex stealer.
How to check if you’re affected
Affected devices are Windows computers where someone pasted and ran a command from a web page or a “verify you are human” style prompt, as the ClickFix lures require. Forescout’s report lists indicators you can search for: the ROMULUS IP addresses 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118 and 2.27.248[.]127 (only the first two are analysed in detail), the domains orbitflownetwork[.]lol (archive delivery) and smashshape[.]com (Legion Loader command-and-control), and file names such as IconEdit2Turb.msi, DeElevate64.exe and DeElevator64.dll, with hashes in the report. The Hacker News’ mitigation advice is to hunt for suspicious PowerShell commands and DLL side-loading events. If a user recalls running a pasted command from a web page, treat the device as potentially compromised and involve your security team.