Hackers Use New ROMULUS Click Fix Platform to Deliver Legion Loader and Other Malware
Summary: Forescout Research - Vedere Labs disclosed a ClickFix delivery platform called ROMULUS that uses bogus landing pages to trick users into running malicious commands and infecting their own machines, and researchers identified six IP addresses running it. The platform exposes two endpoints that download a PowerShell staging script deciding the next payload: a trojanized MSI installer carrying a malware loader, or an encrypted archive containing Legion Loader inflated to nearly 1 GB with repetitive padding to bypass upload limits, sandbox budgets, or static-analysis thresholds.
Why it matters: ROMULUS turns ClickFix from a social engineering trick into a delivery service, and its nearly 1 GB padded archive is built specifically to exhaust the sandbox budgets and static-analysis thresholds defenders rely on. It is not known who operates the platform, and it shares no overlaps with the similarly named RomulusLoader tied to the China-aligned Silver Fox actor.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026