Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Severity

Medium

Detail

Forescout’s Vedere Labs researchers have published an analysis detailing ROMULUS, a newly identified delivery platform utilized to distribute malware through ClickFix social-engineering traps. Discovered during an independent incident investigation and detailed in an October 2026 report, ROMULUS functions as a versatile, modular delivery backend—previously tied to campaigns abusing ChatGPT Custom GPTs—that serves separate infection paths using twelve-character tracking tokens.

The platform leverages hidden PowerShell scripts, integer-encoded IP addresses, DLL sideloading via modified Stardock tools, and heavily padded encrypted archives to bypass security controls and deploy payloads like LegionLoader.

How?

The attack lifecycle begins with ClickFix social-engineering lures, where users visiting malicious websites or compromised AI pages (such as custom ChatGPT GPTs) are tricked by fake verification prompts into manually copying and executing malicious commands.

Once triggered, the ROMULUS backend routes the victim through one of two primary delivery chains:

• Stardock DLL Sideloading Route: This path uses a concealed PowerShell script—reconstructed dynamically from large numeric arrays—to download a malicious MSI installer via a C2 IP address obfuscated as a single decimal integer. Posing as the Stardock Smart DeElevation Tool, the installer runs silently from the temporary directory, removes downloaded-file restrictions, and launches a legitimate application. That application loads a patched malicious DLL from its own directory, executing a sideloading chain that drops secondary loaders.

• Encrypted Archive & LegionLoader Route: The second path deploys a hidden PowerShell window to download a password-protected, multi-layered encrypted archive alongside a legitimate 7-Zip command-line utility. To evade security scanners and sandbox upload limits, the archive contains massive padding (expanding an under-1-megabyte download into an oversized executable exceeding 880 megabytes via relocation-section padding). The payload undergoes a two-stage AES decryption and reversed-byte routine to inject LegionLoader directly into memory.

Once active, LegionLoader registers the infected system, handles C2 communication (using RC4 encryption and Base64 encoding disguised as standard web-form submissions), executes remote PowerShell commands, and steals browser credential material by accessing Chrome Local State key data.

Conclusion

ROMULUS exemplifies the modular nature of modern threat infrastructure, utilizing reusable tracking backends and advanced evasion techniques—such as extreme file padding and trusted software sideloading—to distribute diverse malware families. Security teams must implement comprehensive logging that connects initial browser interactions to downstream process execution.

To mitigate this threat, organizations should monitor endpoint telemetry for suspicious PowerShell script execution, silent MSI installations originating from temporary directories, and unauthorized DLL loads inside application folders. Security teams must configure scanners to inspect oversized or heavily padded binaries rather than skipping them due to size limits, and inspect network traffic for anomalous outbound HTTP form requests containing single Base64 payloads.

Finally, user awareness training must emphasize closing fake verification or CAPTCHA pages that demand manual command-line execution.

Source

https://cybersecuritynews.com/new-romulus-clickfix-platform/