Cybersecurity researchers from **Forescout Research - Vedere Labs** have shed light on **ROMULUS**, a new ClickFix delivery platform being actively used to distribute various malware families, including **Legion Loader**. **ROMULUS** operates as a malware delivery service, employing ClickFix-style lures on fraudulent landing pages. Its primary goal is to deceive unsuspecting users into running malicious commands, ultimately leading to system compromise. "**ROMULUS** may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," noted security researcher **Sai Molige** in a detailed analysis. Forescout's investigation identified six distinct IP addresses associated with the **ROMULUS** operation: * 96.62.224[.]81 * 86.109.75[.]7 * 151.240.151[.]223 * 23.94.145[.]224 * 93.152.224[.]118 * 2.27.248[.]127 ### Connection to ChatGPT Custom GPTs Intriguingly, the IP address 96.62.224[.]81 was previously linked to a campaign abusing malicious **ChatGPT Custom GPTs**. This campaign directed victims to a fake URL, which then served a ClickFix lure, demonstrating the attackers' adaptability in leveraging trending technologies for their schemes. Further analysis by Forescout revealed that the same malware was being delivered via another server, 86.109.75[.]7, which also hosted a panel codenamed **ROMULUS**. Additionally, a separate infection chain triggered by ClickFix involved a PowerShell script that subsequently delivered **Legion Loader** (also known as **Satacom downloader**, **CurlyGate**, and **RobotDropper**).  ### Distinguishing ROMULUS from RomulusLoader While the identity of those behind the **ROMULUS** platform remains unknown, researchers emphasize that it shares no overlap with **RomulusLoader**. The latter is a distinct malware family associated with **Silver Fox** (also known as **TA4922**), a China-aligned threat actor known for using tax-related pretexts to distribute remote access trojans such as **ValleyRAT** (also known as **Winos 4.0**), **DcRAT**, and potentially **Venom RAT** via DLL sideloading techniques. ### Technical Delivery Mechanism The **ROMULUS** platform leverages two primary endpoints to download a PowerShell staging script. This script then determines the subsequent payload: either a trojanized MSI installer containing a malware loader, or an encrypted archive of **Legion Loader**. Notably, the **Legion Loader** archive is inflated to nearly 1 GB with repetitive padding, likely an evasion technique designed to bypass upload limits, sandbox budgets, or static-analysis thresholds. The final loader then communicates with a remote server to fetch and execute additional payloads. ### Mitigating the ClickFix Threat These findings underscore the evolution of ClickFix from a mere social engineering tactic into a potent entry point for sophisticated malware campaigns. To effectively mitigate this threat, organizations and users must prioritize hunting for suspicious PowerShell commands and monitoring for unusual DLL sideloading events.