Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Detection

Security researchers have identified a new delivery platform, called ROMULUS, used to distribute malware via ClickFix-style traps. The system combines hidden PowerShell staging, tampered software installers, and encrypted archives to deliver multiple loaders and payloads.

ROMULUS supports distinct infection routes: one that installs a trojanized MSI which leads to DLL sideloading, and another that fetches encrypted archives and stages LegionLoader in memory. The investigation shows how a single delivery backend can serve different malicious packages while hiding execution behind legitimate tools.

ClickFix techniques rely on social engineering that convinces users to run commands themselves—often through fake verification prompts or “repair” instructions—so that a routine web page becomes the beginning of a Windows compromise.

Forescout’s Vedere Labs discovered ROMULUS during an investigation and published their analysis on October 15, 2026. The team located six IP addresses exposing the same login panel and analyzed two delivery chains. The operators behind ROMULUS are unknown, and researchers found no evidence linking this platform to the separately reported RomulusLoader project.

Connection to earlier ClickFix and ChatGPT-related campaigns

Forescout’s investigation ties ROMULUS to a package previously noted by Huntress in a campaign that abused malicious ChatGPT Custom GPT pages. That activity used AI-driven pages as lures that steered visitors into ClickFix traps. ROMULUS looks like a reusable delivery backend rather than a single-use server for one payload.

Routes on the platform use twelve-character tokens to retrieve either small PowerShell staging scripts or MSI installers. Researchers could not determine whether those tokens encode victim IDs, campaign identifiers, assignment IDs, or simple delivery job names.

One exposed statistics page reported unique installs, total runs, a 14-day history and geographic distribution—features that could let operators measure campaign performance. The available evidence does not, however, reveal whether ROMULUS is a private in-house tool, a paid criminal service, an affiliate platform, or software shared among separate groups.

Hidden PowerShell staging and DLL sideloading

Both recovered PowerShell scripts followed the same core design: they reconstructed obfuscated code from large numeric arrays, executed it with PowerShell, and then deleted themselves. Variable and key name changes gave individual samples different appearances while retaining the same execution flow.

The first route downloaded an MSI using an IP address represented as a single decimal number rather than dotted-quad form. The installer was written to the temporary folder, had its “downloaded file” restriction removed, and was launched with Windows Installer in silent mode. As with other ClickFix MSI attacks, this demonstrates why defenders should examine the full process chain rather than trusting the installer’s presence alone.

The MSI impersonated the Stardock Smart DeElevation Tool and executed a legitimate host executable after installation. That program loaded a patched DLL from its folder, and the patched DLL in turn loaded a malicious loader. This DLL sideloading chain let attackers use legitimate software as the starting point for harmful execution.

The second route hid a PowerShell console, downloaded an encrypted 7-Zip archive alongside the legitimate 7-Zip command-line utility, and used nested archives. The outer archive contained a password-protected inner archive; the inner archive’s password was stored in a text file extracted from the outer archive. Encrypted archive headers obscured filenames and contents from scanners that lack the password.

The final extracted executable was reported as 882,716,672 bytes in size, but most of that came from repeated padding in the relocation section. An archive under one megabyte can therefore expand into an executable large enough to exceed some upload limits, sandbox resource budgets, or scanning thresholds—an evasion technique rather than proof that any specific product failed.

Two unpacking stages used AES encryption and reversed decrypted bytes before loading LegionLoader into memory. LegionLoader has been seen in other delivery chains; earlier reporting documents its broader use but does not prove shared operators. Researchers also found several additional binary artifacts whose purpose remained unclear.

Once installed, LegionLoader registered infected hosts, polled for commands, executed PowerShell commands on demand, and supported additional payload downloads. It also accessed Chrome Local State key material to harvest sensitive browser data. Its command traffic used RC4 encryption and Base64 encoding inside requests that appeared to be ordinary web form submissions.

Forescout recommends that defenders review PowerShell script logs, look for silent MSI installations originating from temporary folders, monitor for unusual DLL loads, and investigate unusually large executables. With adequate network visibility, teams can hunt for form-like HTTP requests containing a single Base64 blob instead of expected form fields.

Related Forescout ClickFix loader research highlights the importance of correlating browser activity, script execution, and subsequent network traffic rather than treating each event in isolation. Users should close verification or “repair” pages that request command execution. Security teams should also reevaluate files that were skipped by scanners because of size limits. The indicators below support investigation, but the earlier stager’s direct connection to ROMULUS remains unconfirmed. No single indicator should replace a review of the surrounding process, file, and network evidence together.

Indicators of compromise (IoCs)

Network and delivery indicators

SHA-256 file hashes

All hashes below are SHA-256 values reported in Forescout’s analysis. The legitimate host executable is included for correlation, not as evidence that the file itself is malicious.

Supporting archive artifacts

Reported archive passwords below are analysis artifacts from the source and should be treated as investigative leads rather than standalone proof of compromise.

Note: IP addresses and domains are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from your SOCs.