ClickFix Trick Reused: ROMULUS Backend Evades Scanners to Install LegionLoader

People who fall for ClickFix social engineering scams now face a more organized threat. Cybercriminals are using a shared backend called ROMULUS to deliver multiple types of malware. This infrastructure allows attackers to reuse the same delivery methods across different campaigns, increasing the risk for anyone who runs unsolicited commands.

Security researchers at Forescout’s Vedere Labs discovered the ROMULUS platform on October 14. They found that malware delivered via ClickFix was hosted on servers running this new panel. The discovery links infrastructure from a ChatGPT abuse campaign to other incidents, showing a connected network of malicious activity.

How the platform works

ROMULUS operates as a multi-payload delivery system rather than a single-purpose server. Analysts identified six different servers hosting the platform. This setup suggests the tool is being used at scale by various cybercriminals. The system separates delivery routes for PowerShell scripts and trojanized installers, allowing flexible deployment of different threats.

One notable tactic involves disguising operations to evade detection. Researchers observed LegionLoader being distributed through encrypted archives. These files contain an executable artificially inflated to approximately 842 MiB. This size likely exceeds limits set by security scanning tools, helping the malware slip past automated checks.

Who is affected

The primary targets are individuals who interact with fake verification pages or support scams. Attackers trick victims into running malicious PowerShell commands on their own machines. Because the user executes the commands, security protections often fail to block the action. The platform has been linked to campaigns abusing ChatGPT Custom GPTs and other social engineering vectors.

Our take on the response

The existence of a shared, reusable backend like ROMULUS indicates a shift in how these attacks are organized. Instead of one-off scams, criminals are building infrastructure that can be rented or shared. This makes detection harder because the same server can host different malware families. No patch or fix has been confirmed yet for this infrastructure.

For customers and users

If you encounter a request to run a script or download a file via a browser or chat, stop immediately. Do not paste commands into your terminal or command prompt. Verify the request through a separate, trusted channel before taking any action. Teams usually monitor for unusual PowerShell activity or large file downloads. Check whether your security logs show any recent executions of MSI installers or scripts that delete themselves after running. Be wary of fake support pages that ask you to fix errors by running code.

What to do and how to stay safe: ROMULUS

• Verify any request to run commands or download files through a known, trusted communication channel before proceeding.
• Monitor system logs for unexpected PowerShell executions or silent installation of MSI packages, especially those triggered by web browsers.
• Ensure your security software is configured to alert on large file downloads or encrypted archives that may bypass standard scanning limits.
• Educate users on recognizing ClickFix scams, which often involve fake verification pages or urgent support requests directing them to run scripts.

Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is ROMULUS?

ROMULUS is a shared server hosting panel that facilitates the delivery of multiple malware payloads through ClickFix scams.

How many servers are involved?

Forescout analysts identified six different servers running the ROMULUS platform.

What malware does it deliver?

The platform has been observed distributing LegionLoader and trojanized Stardock application packages.