Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity.
The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious commands, often under the pretence of fixing a technical problem or completing a verification step.
The investigations reveal how attackers deliver different malware families, conceal malicious files and establish access that could support further compromise.
ROMULUS serves multiple malware loaders
During an incident investigation, Forescout researchers discovered a server hosting a panel called ROMULUS. Further analysis identified six IP addresses exposing the same authentication interface and revealed a platform capable of delivering multiple malware loaders.
One of those addresses had previously been identified by Huntress in a campaign that abused ChatGPT’s Custom GPTs to direct victims towards pages hosting ClickFix lures. Forescout independently observed the same malware package being delivered from another ROMULUS server.
Researchers analysed two delivery routes. One used a trojanised installer containing legitimate Stardock software to load malicious code. The other delivered LegionLoader, a malware loader active since 2019, through a series of encrypted archives.
In the LegionLoader route, an archive smaller than 1 MB expanded into an executable exceeding 880 MB. Most of the executable’s size came from artificial padding, which can push files beyond security scanners’ upload limits or sandbox analysis thresholds.
A ROMULUS statistics page also displayed installation and execution counts, a timeline and a breakdown by country, potentially allowing operators to monitor campaign performance.
Forescout said the platform’s operators remain unknown. Researchers could not determine whether ROMULUS is a private tool, a commercial criminal service, an affiliate framework or software shared between operators.
Loader investigation reveals possible connection
The second blog examines Lorem Ipsum and Axolotl, two malware loaders whose relationship had not previously been documented in public research.
The investigation followed a September incident in which attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained the incident before ransomware was deployed, although researchers believe ransomware delivery was the attackers’ intended goal.
The tradecraft has previously been attributed to Vice Society, a cybercriminal group associated with several ransomware families, including Rhysida.
Researchers analysed five Lorem Ipsum samples from the incident and 39 Axolotl samples. They identified an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, as well as three Axolotl variants using different host programs.
The analysis also found overlapping infrastructure and similarities in the loaders’ command-and-control communications. Although their code is distinct, Forescout said the findings suggest Lorem Ipsum may be a later iteration of Axolotl. Researchers could not establish that relationship conclusively.
Forescout recommends monitoring suspicious PowerShell activity, silent installer execution and unexpected DLL loading, alongside educating users about ClickFix and related lures that direct victims to Windows Terminal or PowerShell.
