ROMULUS ClickFix Platform Powers New Malware Delivery Campaigns

Introduction

A sophisticated malware delivery infrastructure known as ROMULUS has emerged as a potent force in the cybercrime ecosystem, leveraging the increasingly popular ClickFix technique to distribute LegionLoader and a rotating cast of secondary payloads. Uncovered by researchers at Forescout's Vedere Labs, this platform represents a significant maturation in how threat actors package and deploy social engineering attacks at scale. Rather than relying on traditional phishing emails or exploit kits, ROMULUS automates the creation of convincing fake interfaces — such as bogus CAPTCHA verifications, browser update prompts, and document preview errors — that manipulate victims into copying and executing malicious PowerShell commands directly into their terminals.

This analysis dissects the ROMULUS platform's operational model, its reliance on user-driven execution chains, and the broader implications for enterprise security postures. We examine how the service lowers technical barriers for affiliates, the specific malware families observed in its distribution pipeline, and why conventional endpoint defenses often fail to intercept these attacks before compromise occurs.

Deconstructing the ClickFix Infection Chain

The ClickFix methodology — where users are tricked into pasting attacker-controlled commands into their own systems — has rapidly become a preferred initial access vector. ROMULUS industrializes this approach by providing a backend framework that generates dynamic, context-aware lure pages tailored to the victim's environment. When a target visits a compromised or malicious site serving a ROMULUS payload, the platform fingerprints the browser, OS, and language settings to serve a highly convincing decoy: a fake Cloudflare verification, a simulated "document not found" error with a "fix" button, or a fraudulent browser update notice.

Upon interaction, the victim is presented with a multi-step instruction set — often involving keyboard shortcuts like Win+R, Ctrl+V, and Enter — that results in the execution of a base64-encoded PowerShell one-liner. This command fetches and executes the next-stage loader, typically LegionLoader, which then establishes persistence and pulls down information stealers, remote access trojans, or ransomware. The brilliance of this chain lies in its evasion of traditional email gateways, attachment sandboxing, and even many web proxies, since the malicious payload is never delivered as a file — it is constructed in memory via user action.

LegionLoader: The Primary Payload of Choice

LegionLoader has become the workhorse of ROMULUS campaigns, valued for its modularity, anti-analysis features, and proven track record as a pay-per-install affiliate tool. Once executed, LegionLoader performs extensive environment checks — scanning for virtualization artifacts, debuggers, and security products — before decrypting its configuration and contacting command-and-control infrastructure. It then deploys a configurable suite of secondary malware, which in recent ROMULUS operations has included:

• Lumma Stealer — targeting cryptocurrency wallets, browser credentials, and 2FA extensions
• RedLine Stealer — harvesting FTP logs, VPN configs, and autocomplete data
• Remcos RAT — providing full remote desktop control and keylogging
• ClipBanker — hijacking clipboard operations to redirect crypto transactions

This payload flexibility allows ROMULUS operators to monetize infections through multiple channels simultaneously: credential theft, financial fraud, botnet recruitment, and ransomware deployment. The loader's use of legitimate Windows binaries (LOLBins) like mshta.exe, regsvr32.exe, and powershell.exe further complicates behavioral detection.

ROMULUS as a Service: Lowering the Barrier to Entry

What distinguishes ROMULUS from prior ClickFix campaigns is its apparent operation as a structured Malware Delivery as a Service (MDaaS). Forescout's telemetry suggests the platform provides affiliates with a dashboard to customize lure templates, select payload combinations, track infection metrics, and manage cryptocurrency payouts. This service model mirrors legitimate SaaS platforms, complete with versioned updates, uptime guarantees, and customer support channels on underground forums.

By abstracting away the complexity of web hosting, domain rotation, obfuscation, and payload staging, ROMULUS enables low-skill actors to launch high-efficacy campaigns. The platform also employs fast-flux DNS and compromised legitimate websites as redirectors, making infrastructure takedowns whack-a-mole exercises. Critically, the user-driven execution model shifts the "click" from an email link to a deliberate keyboard sequence — a distinction that bypasses many user behavior analytics tools trained on phishing click patterns.

Detection Gaps and Defensive Blind Spots

Standard security stacks exhibit consistent gaps against ROMULUS-style attacks. Email security gateways see no malicious attachment or link. Web proxies observe only benign-looking HTML and JavaScript — the malicious command exists only in the DOM and clipboard. Endpoint detection often triggers only after LegionLoader executes, by which time the attacker has a foothold. Network IDS/IPS misses the initial payload because it's delivered via HTTPS to a constantly rotating set of domains, many hosted on compromised legitimate infrastructure.

Effective detection requires correlating anomalous user behavior: rapid clipboard-to-terminal transitions, execution of encoded PowerShell from interactive sessions, and child processes of explorer.exe or cmd.exe spawning scripting engines. However, these signals are noisy in admin-heavy environments. The most reliable telemetry comes from kernel-level ETW monitoring and AMSI inspection of script content after deobfuscation — capabilities that remain under-deployed in mid-market organizations.

Attribution and Threat Actor Ecosystem

While Forescout has not publicly attributed ROMULUS to a specific named group, operational overlaps suggest connections to the broader LegionLoader affiliate network, which has historically serviced Eastern European cybercrime syndicates. The platform's codebase shows reuse of obfuscation routines seen in prior ClickFix campaigns linked to TA571 and TA577 (Proofpoint designations), known for high-volume malspam operations that have pivoted to web-based delivery as email defenses improved. The use of Russian-language strings in panel interfaces and the acceptance of rubles alongside cryptocurrency in affiliate payouts further points to a CIS-origin operator.

Notably, ROMULUS does not appear to be a state-sponsored tool — its indiscriminate targeting of SMBs, educational institutions, and healthcare providers aligns with financially motivated crime. However, the platform's modularity means it could be subcontracted for initial access in more targeted operations, blurring the line between commodity crime and APT facilitation.

Conclusion

The ROMULUS platform exemplifies how threat actors continuously refine the economics of compromise — shifting investment from exploit development to psychological manipulation and automation. By turning the user into the execution vector, ClickFix techniques bypass decades of perimeter-centric security architecture. LegionLoader's role as a universal payload bus ensures that each successful infection becomes a multiplexed revenue stream. For defenders, the lesson is clear: the endpoint is no longer the last line of defense; it's the battlefield. Mitigating this class of attack demands a fusion of technical controls — application control, script block logging, clipboard monitoring — and a cultural shift in user awareness. At Grivyonx Cloud, our AI-driven endpoint detection and automated response platform is engineered to identify the behavioral fingerprints of user-driven execution chains in real time, stopping LegionLoader and its kin before they establish persistence. The ROMULUS campaign won't be the last to weaponize human trust — but with the right visibility, it can be the last to succeed in your environment.