New ROMULUS Platform Abuses ClickFix Lures to Spread Malware
Attackers are using a new malware delivery platform called ROMULUS to trick users into downloading threats like LegionLoader. The scheme relies on deceptive landing pages that mimic legitimate software update prompts.
TL;DR
- ROMULUS is a new malware-as-a-service platform using ClickFix-style social engineering tactics.
- It tricks users into running malicious commands through fake software update pages.
- LegionLoader and other payloads are being distributed via this method.
- Organizations should train staff to verify software updates through official channels.
- Security teams need to monitor for suspicious redirects and unauthorized PowerShell usage.
Cybercriminals have launched a new malware delivery operation called ROMULUS, which leverages deceptive social engineering techniques to compromise victims. This platform functions similarly to previous ClickFix campaigns, where users are manipulated into executing malicious code on their own systems.
According to research from Forescout's Vedere Labs, ROMULUS operates by directing victims to fraudulent landing pages designed to look like routine software maintenance interfaces. These convincing decoys prompt visitors to run seemingly harmless commands that actually install dangerous payloads such as LegionLoader.
How ROMULUS Works
- ROMULUS uses fake software update pages to lure victims into running malicious scripts
- The platform mimics legitimate technical support interfaces to gain user trust
- Victims unknowingly execute PowerShell commands that download and install malware
- Initial access is achieved through phishing links or compromised websites hosting the ROMULUS framework
Defensive Recommendations
- Train employees to verify all software update requests through official vendor channels
- Implement strict policies against running unexpected PowerShell commands
- Monitor network traffic for connections to known malicious domains associated with ROMULUS
- Deploy endpoint detection solutions that flag suspicious script execution patterns
- Regularly audit browser security settings to prevent automatic downloads from untrusted sources
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.