A newly documented attack platform called ROMULUS is giving criminals a flexible backend for one of the fastest-growing social engineering techniques in circulation: ClickFix. Rather than exploiting a software flaw, ClickFix attacks rely on convincing a victim to copy and paste a command into their own machine, typically under the guise of a fake CAPTCHA, browser error, or “fix this issue” prompt. Researchers at Forescout’s Vedere Labs uncovered ROMULUS while investigating an unrelated incident and published their findings on October 15.

What sets ROMULUS apart from a typical one-off ClickFix page is its apparent design as reusable infrastructure. The team found six separate IP addresses exposing an identical login panel, along with a dashboard tracking install counts, run totals, and a fourteen-day campaign history by country — features that resemble a legitimate SaaS analytics product more than a disposable criminal tool. Forescout notes the operators remain unidentified and that no confirmed link exists to a separately reported and similarly named threat, RomulusLoader.

Two Infection Paths, One Shared Backend

Forescout’s analysis traced two distinct delivery chains running through ROMULUS, both reached through twelve-character access tokens embedded in URLs that researchers could not definitively identify as victim, campaign, or job identifiers.

Route one: a trojanized Stardock utility

The first chain delivers an MSI installer disguised as Stardock’s “Smart DeElevation Tool,” a legitimate Windows utility. Once run, it quietly installs the real Stardock executable, which in turn loads a tampered DLL sitting in the same folder — a classic DLL sideloading technique that lets malicious code execute under the cover of a trusted, digitally legitimate program.

Route two: encrypted archives and LegionLoader

The second chain hides a PowerShell window and downloads an encrypted archive bundled with a legitimate copy of the 7-Zip command-line tool. The archive is nested — a password-protected file inside another password-protected file, with the inner password supplied by an accompanying text file — a layering technique designed specifically to blind scanners that can’t see inside encrypted containers without the key.

Once unpacked, the final payload turned out to be artificially inflated to roughly 882 megabytes through repeated padding, likely to push the file past the size limits of automated sandboxes and upload-based scanning tools. After two further unpacking stages using AES encryption, the chain ultimately loads LegionLoader, a malware loader already documented in unrelated campaigns, directly into memory.

What LegionLoader Does Once Installed

• Registers the infected system with a command-and-control server and awaits further instructions
• Executes additional PowerShell commands and retrieves follow-on payloads
• Reads Chrome’s Local State file to access key material tied to stored browser data
• Disguises its command-and-control traffic as ordinary web form submissions, encrypted with RC4 and encoded in Base64

Forescout also connected part of the ROMULUS infrastructure to an earlier campaign documented by Huntress that abused ChatGPT Custom GPT pages to funnel visitors toward ClickFix prompts — suggesting the same delivery backend, or a closely related one, has already been used alongside AI-platform-themed lures.

Detection Guidance

Because ROMULUS chains lean heavily on living-off-the-land techniques — legitimate installers, signed executables, and built-in Windows tools like PowerShell — Forescout recommends defenders focus on behavioral indicators rather than static signatures:

• Review PowerShell script logs for scripts that rebuild and execute code from large numeric arrays, then delete themselves on exit
• Flag silent MSI installations launched from temporary folders outside normal software deployment workflows
• Watch for DLL loads from unexpected directories immediately following installation of otherwise legitimate utilities
• Inspect outbound web requests for single Base64-encoded blobs submitted in place of normal form fields
• Treat unusually large executables extracted from small archives as a potential evasion signal worth manual review

For end users, the simplest defense remains behavioral: legitimate websites and software never require you to manually copy, paste, and run a command to “fix” an error or pass a verification check. Closing the browser tab and navigating away is sufficient to stop a ClickFix attempt before it starts, regardless of which backend platform happens to be powering it.