Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives.

The platform supports separate infection paths, including one that installs LegionLoader and another that abuses a legitimate Stardock program to load malicious code.

The findings show how a single delivery system can serve different malware packages while hiding activity behind trusted tools.

ClickFix tricks people into running commands themselves, often through fake verification prompts or repair instructions, turning an ordinary browser visit into the start of a Windows infection.

Researchers from Forescout’s Vedere Labs identified ROMULUS while investigating an independent incident and published their analysis on October 15, 2026.

They found six IP addresses exposing the same login panel and examined two delivery chains. The operators remain unknown, and researchers found no evidence linking this platform to the separately reported RomulusLoader.

Hackers Use New ROMULUS ClickFix Platform

The investigation connected the platform to a package previously described by Huntress in a campaign abusing ChatGPT Custom GPTs. That earlier activity used AI pages to direct visitors toward ClickFix traps.

Coverage of malicious ChatGPT Custom GPTs explains how trusted service pages became entry points for malware installation. ROMULUS appears to function as a reusable delivery backend rather than a server built for one payload.

Its routes use twelve-character tokens to fetch either PowerShell staging scripts or malicious MSI installers. Researchers could not confirm whether those tokens identify victims, campaigns, assignments, or delivery jobs.

One exposed statistics page tracked unique installs, total runs, a fourteen-day history, and countries. These features could help operators measure campaign performance.

However, the evidence does not establish whether ROMULUS is a private tool, a paid criminal service, an affiliate system, or software shared between different groups.

Hidden PowerShell and DLL Sideloading

Both recovered scripts used the same basic design, rebuilding concealed code from large arrays of numbers before running it through PowerShell. Each script also removed itself before exiting.

Changing keys and variable names gave individual samples different appearances while preserving the same overall execution pattern.

The first route downloaded an MSI through an IP address written as one decimal number rather than familiar dotted notation. It saved the installer in the temporary folder, removed its downloaded-file restriction, and launched Windows Installer silently.

Similar ClickFix MSI installation attacks show why defenders should examine the full process chain instead of trusting an installer alone. The package posed as Stardock Smart DeElevation Tool and launched a genuine executable after installation.

That program loaded a patched DLL from its own folder, which then pulled in the malicious loader. This DLL sideloading chain let attackers use legitimate software as the starting point for harmful execution.

The second route hid its PowerShell window and downloaded an encrypted archive alongside the legitimate 7-Zip command-line utility.

One password-protected archive contained another, whose password came from an accompanying text file. Encrypted archive headers concealed filenames and contents from scanners lacking the password.

The extracted executable measured 882,716,672 bytes, but most of that size came from repeated padding in its relocation section.

An archive smaller than one megabyte could therefore expand into a file large enough to exceed some upload limits, sandbox budgets, or scanning thresholds. This was an evasion method, not proof that every security product failed.

Two unpacking stages used AES encryption and reversed decrypted bytes before loading LegionLoader into memory. Earlier reporting on other LegionLoader delivery chains documents its use beyond ROMULUS, but does not establish shared operators. Researchers also found five binary files whose purpose remained unclear.

LegionLoader registered infected systems, received commands, supported PowerShell execution, and handled additional payload downloads.

It also accessed Chrome Local State key material to collect sensitive browser information. Its command traffic used RC4 encryption and Base64 encoding inside requests labeled as ordinary web forms.

Forescout recommends checking PowerShell script logs, silent MSI installs from temporary folders, unusual DLL loads, and oversized executables.

With suitable network visibility, defenders can hunt for form requests containing one Base64 blob instead of normal fields. Related Forescout ClickFix loader research reinforces the value of connecting browser activity, script execution, and later network traffic rather than treating each event separately.

Users should close verification pages that demand command execution. Security teams should also review files skipped because of size limits. The source indicators below support investigation, while the earlier stager’s direct ROMULUS connection remains unconfirmed. No single indicator should replace review of the surrounding process, file, and network evidence together.

Indicators of compromise (IoCs):-

Network and Delivery Indicators

SHA-256 File Hashes

All hashes below are SHA-256 values reported in Forescout’s analysis, including two helper-module hashes listed in its component table. The legitimate host executable is included for package correlation, not as proof that the file itself is malicious.

Supporting Archive Artifacts

These passwords are analysis artifacts from the source, rather than standalone evidence of compromise.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.