ROMULUS: a ClickFix delivery platform built to feed Legion Loader and other malware

ClickFix no longer looks like a one-off social-engineering trick. It's turning into infrastructure. Researchers have documented ROMULUS, a panel-driven delivery platform that hosts fake ClickFix landing pages, talks the visitor into pasting and running a command, and then decides which malware to hand over. One of those payloads is Legion Loader, a loader also tracked as Satacom downloader, CurlyGate and RobotDropper.

What happened

ROMULUS works like a small malware-delivery service. Every server runs the same login page and the same routing scheme, with token-based paths under /s/<token> and /app/<token>. When a victim follows the ClickFix lure, which is usually a fake "verification" or "fix" prompt, they paste and run a command on their own machine. That command pulls down a PowerShell staging script. The script picks the next stage: either a trojanized MSI installer carrying a loader, or an encrypted archive containing Legion Loader. Once it's running, the loader contacts a remote server to fetch and run more payloads.

Researchers found ROMULUS on six IP addresses (defanged):

• 96.62.224[.]81
• 86.109.75[.]7
• 151.240.151[.]223
• 23.94.145[.]224
• 93.152.224[.]118
• 2.27.248[.]127

One of these hosts, 96.62.224[.]81, had already appeared in an earlier campaign. That campaign used malicious ChatGPT Custom GPTs to send people to a fake URL serving a ClickFix lure. Two of the servers delivered an identical payload (a Stardock DeElevation-based package), which suggests one operator, or one shared toolkit, behind them.

Who runs it is still unknown. The researchers say ROMULUS could be a private panel, a commercial cybercrime service, an affiliate framework, or software copied between operators. It shows no overlap with the similarly named RomulusLoader malware linked to the China-aligned Silver Fox group (TA4922). We don't attribute it to any actor.

Why it matters

• The user runs the attack for the attacker. ClickFix gets around a lot of email and download filtering because the victim pastes and runs the command. There's often no attachment or exploit to catch.
• Delivery-as-a-service scales. A panel that routes visitors to different payloads lets one lure page serve many campaigns and many malware families, and operators can swap payloads quickly.
• Loaders open the door. Legion Loader's job is to bring in whatever comes next, such as stealers, crypto miners or remote access tools. One pasted command can lead to a much larger compromise.

What to do

1. Hunt for suspicious PowerShell. Look for encoded or download-and-execute one-liners started from explorer.exe or the Run dialog (RunMRU), and for PowerShell fetching MSI or archive files from raw IP addresses.
2. Watch for DLL sideloading. Alert on signed binaries loading unsigned DLLs from user-writable folders, a common way loaders persist.
3. Restrict script and installer execution. Use Constrained Language Mode, AppLocker/WDAC policies, and block msiexec from fetching remote packages for standard users.
4. Block and sweep the IOCs. Add the IPs above to your blocklists, and search proxy, DNS and EDR logs for past contact with them.
5. Train people on the exact lure. Tell staff plainly that no legitimate website, CAPTCHA or "fix" will ever ask them to paste a command into Windows Run, PowerShell or a terminal.

ClickFix campaigns change payloads quickly, so it helps to test whether your controls actually stop a pasted command before an attacker tries it. Our penetration testing team simulates these user-driven execution chains to show where PowerShell, MSI and sideloading controls hold up and where they don't.

Credit: based on research by Forescout Research – Vedere Labs, as reported by The Hacker News (20 Oct 2026).