"ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," security researcher Sai Molige said in an analysis.
Forescout Research - Vedere Labs describes ROMULUS as a ClickFix delivery platform
Cybersecurity researchers at Forescout Research - Vedere Labs disclosed that a ClickFix delivery platform dubbed ROMULUS is being used to distribute malware, including Legion Loader. The company characterizes ROMULUS as a delivery mechanism that leverages ClickFix-style lures hosted on bogus landing pages to trick users into running malicious commands and thereby executing payloads themselves.
Observed infrastructure: six IP addresses and at least one ROMULUS panel
- Forescout identified six Internet Protocol addresses associated with ROMULUS activity: 96.62.224[.]81; 86.109.75[.]7; 151.240.151[.]223; 23.94.145[.]224; 93.152.224[.]118; and 2.27.248[.]127.
- The IP address 96.62.224[.]81 was linked to a ClickFix script and an MSI installer file in a campaign that used malicious ChatGPT Custom GPTs to direct victims to a fake URL serving the ClickFix lure.
- Forescout's analysis also uncovered the same malware being delivered from 86.109.75[.]7, a server that hosted a panel codenamed ROMULUS.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPayloads observed: Legion Loader (aka Satacom downloader), trojanized MSI, and additional loaders
Forescout reported multiple delivery chains that begin with ClickFix lures. One chain executes a PowerShell script which then delivers Legion Loader — described in the findings as "a malware loader also called Satacom downloader, CurlyGate, and RobotDropper." The ROMULUS platform itself exposes two endpoints designed to download a PowerShell staging script that decides the next-stage payload: either a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader.
Once installed, the loader communicates with a remote server to fetch and run additional payloads, turning the initial social-engineering contact into an automated conduit for follow-on malware.
No attributed operator; distinction from RomulusLoader and Silver Fox (TA4922)
As of writing, Forescout stated it is not known who operates the ROMULUS platform. The researchers also emphasized that ROMULUS shares no overlaps with RomulusLoader, a separate malware family associated with Silver Fox (aka TA4922). Forescout noted that Silver Fox is a China-aligned threat actor that has repeatedly used tax-related pretexts to distribute remote-access trojans such as ValleyRAT (aka Winos 4.0), DcRAT, and potentially Venom RAT via DLL sideloading techniques — a distinct pattern from the ROMULUS deliveries described.
What this means for technologists and end users
- Technologists and security teams: The ROMULUS findings point to ClickFix lures evolving into a scalable delivery platform. Forescout recommends hunting for suspicious PowerShell commands and for DLL sideloading events — the specific observable behaviors tied to the ROMULUS chains described.
- End users and administrators responsible for endpoints: The attacks rely on bogus landing pages and scripted prompts that coax users into running commands or installers. Forescout's evidence includes a campaign that used malicious ChatGPT Custom GPTs to steer victims to the fake URL responsible for the ClickFix lure, underscoring how interactive, AI-driven content can be repurposed to facilitate social-engineering delivery.
The ROMULUS work underscores a narrower technical truth exposed by Forescout's research: ClickFix-style lures are no longer merely a one-off social-engineering trick but can be turned into a repeatable delivery pipeline that hands control to staging scripts and loaders. With six IPs tied to observable activity, a panel codenamed ROMULUS, and explicit cases where malicious ChatGPT Custom GPTs were used as a vector to reach a ClickFix landing page, defenders have concrete telemetry to hunt and harden around — and specific behaviors to look for. Forescout's bottom-line mitigation mirrors that telemetry: look for suspicious PowerShell execution and DLL sideloading events.
Source: https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
