Image courtesy by QUE.com
Cybersecurity researchers at Forescout Research's Vedere Labs have uncovered a sophisticated new malware delivery platform dubbed ROMULUS, which is transforming the ClickFix social engineering technique from a one-off attack trick into a scalable, multi-payload distribution ecosystem. The discovery, detailed in October 2026, reveals how cybercriminals are industrializing malware delivery in ways that make detection and prevention significantly harder for organizations worldwide.
What Is ROMULUS?
ROMULUS is a multi-payload shared ClickFix delivery platform that operates as a reusable backend for distributing various forms of malware to unsuspecting victims. Unlike traditional malware servers that are hard-coded to deliver a single payload, ROMULUS functions more like a content delivery network for cybercriminals, capable of serving different malware families through multiple attack routes from the same infrastructure.
The platform was discovered when Forescout analysts were investigating an independent security incident. They noticed that the exact same malware delivered in a previously reported ClickFix campaign, which had abused ChatGPT Custom GPTs to lure victims, was also connected to another server. That server hosted a dark-themed authentication panel called ROMULUS, complete with a shield icon and login functionality.
The ClickFix Attack Vector
ClickFix has become one of the most popular methods for malware deployment over the past year. The technique relies on social engineering to trick victims into running attacker-supplied commands on their own machines. Typically, users encounter a fake error message or verification prompt on a malicious webpage, instructing them to copy and paste a seemingly innocent command into their terminal or Run dialog.
What makes ClickFix particularly dangerous is that it relies on the legitimate, trusted user of the machine to execute the commands. This means the action often bypasses security protections designed to stop unauthorized processes, since the operating system sees it as a voluntary user action rather than an automated intrusion.
Six ROMULUS Servers Identified
Forescout researchers identified a total of six different IP addresses running ROMULUS instances, suggesting the infrastructure is being operated at scale. By pivoting on VirusTotal and Shodan searches for the ROMULUS login page theme, analysts uncovered servers that all exposed the same dark-themed authentication frontend with the ROMULUS branding.
One of these servers was previously identified by Huntress as part of a campaign that abused ChatGPT Custom GPTs to direct victims to ClickFix lures. The discovery of additional servers running the same platform indicates that ROMULUS may be:
- A privately operated panel used by a single threat group
- A commercial cybercriminal delivery service offered to multiple actors
- An affiliate framework where operators earn from successful infections
- Software that has been copied and distributed among different operators
The true identity of the operator behind ROMULUS remains unknown. Notably, researchers confirmed that this platform is entirely separate from RomulusLoader, a different malware family identified by Proofpoint earlier in 2026 and associated with the Silver Fox threat actor.
Route A: Stardock DeElevation DLL Sideloading
The first delivery route identified by researchers involves a trojanized MSI installer that exploits DLL side-loading through a legitimate Stardock application. The staging script downloads an MSI file disguised as a Stardock Smart DeElevation Tool, which is then silently installed using msiexec with hidden window parameters.
Once installed, the legitimate DeElevate64.exe executable loads a patched version of DeElevator64.dll from its application directory. This patched DLL introduces a dependency on a malicious loader, which in turn executes additional malware components packaged within the MSI. The chain demonstrates how attackers abuse trusted software signatures and legitimate applications to bypass security controls.
Route B: LegionLoader Through Encrypted Archives
The second delivery route is more elaborate and involves the deployment of LegionLoader, a malware loader that has been active since 2019 and is also known by the names CurlyGate, RobotDropper, and Satacom. This chain uses a multi-layered encrypted archive approach to evade detection.
The staging script downloads a password-protected 7z archive along with the legitimate 7zr.exe extraction utility from GitHub. The archive is extracted using a hardcoded password, revealing another encrypted 7z file and a text file containing a second password. After the second extraction, the contents include five high-entropy binary files and an executable artificially inflated to approximately 842 megabytes.
The 842 MB Inflation Trick
One of the most notable evasion techniques in Route B is the artificial inflation of the executable file. The PE file contains a massive .reloc section of roughly 881.7 MB filled with repeating 16-byte values, while the actual relocation data occupies only 108 bytes. This padding causes the file to expand to a size that exceeds the upload limits and analysis budgets of many security scanning tools and sandboxes.
The meaningful code and encrypted payload are concentrated in the first 2 MB of the file. Because the padding is highly repetitive, it compresses extremely well, allowing attackers to distribute an archive under 1 MB that expands into a file too large for many automated analysis systems to process. This clever technique effectively blinds traditional security tools to the actual malicious content.
LegionLoader Capabilities
Once deployed, LegionLoader communicates with its command-and-control server using a distinctive protocol. Messages are serialized into a compact binary format, encrypted with an RC4 key, and base64-encoded before being sent via HTTP. The C2 endpoints handle registration, command retrieval, and result reporting.
LegionLoader also targets the Chrome browser specifically, accessing the Local State file to retrieve encryption keys and harvest sensitive information stored in the victim's browser. This includes saved credentials, cookies, and other browsing data that can be used for further exploitation or sold on dark web marketplaces.
Detection and Mitigation Strategies
Forescout researchers provided several detection opportunities for organizations looking to defend against ROMULUS and similar ClickFix-based attacks:
- Monitor PowerShell anomalies: Watch for PowerShell launched with -NoProfile, -ep bypass, or -w hidden flags alongside URLs in the command line. Long scripts executed from the TEMP directory are especially suspicious.
- Track silent MSI installations: Correlate silent MSI installs from TEMP directories with subsequent executable launches, particularly when preceded by Unblock-File operations.
- Detect decimal IP notation: Search command lines and script logs for HTTP URLs followed by 8 to 10 decimal digits, which represent IP addresses in decimal format designed to evade simple pattern matching.
- Flag oversized executables: Alert on very large executable files written to user-writable paths. A massive .reloc section with minimal actual relocation data is a strong indicator of artificial inflation.
- Monitor DLL side-loading: Track module loads from unexpected application directories and compare DLL hashes against known legitimate inventories.
- Watch for archive extraction chains: Correlate PowerShell downloading 7z extraction tools followed by password-protected archive extraction and execution of new binaries from extraction directories.
The Broader Implications
The ROMULUS platform represents a significant evolution in how malware is delivered at scale. By turning ClickFix from a simple social engineering trick into a reusable, multi-payload delivery infrastructure, cybercriminals have effectively created a malware-as-a-service model that lowers the barrier to entry for less technically sophisticated threat actors.
The use of legitimate tools like 7-Zip, legitimate applications like Stardock software, and trusted platforms like Discord for command and control demonstrates how attackers continue to blur the line between benign and malicious activity. Security teams must adopt behavioral detection approaches that examine the full context of process execution rather than relying solely on signature-based defenses.
As ClickFix campaigns continue to evolve and platforms like ROMULUS proliferate, organizations should prioritize user awareness training, implement robust endpoint detection and response solutions, and maintain vigilance against the increasingly creative methods attackers use to bypass security controls. The threat landscape of 2026 makes clear that malware delivery is becoming industrialized, and defenses must scale accordingly.
Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous
Articles published by QUE.COM Intelligence via Yehey.com website.
0 Comments