In the latest episode of "Things That Shouldn't Exist," cybersecurity researchers have uncovered ROMULUS, a shiny new platform designed for delivering malware like Legion Loader. Because apparently, just tricking users into clicking a link wasn’t enough anymore.
According to Forescout Research - Vedere Labs, ROMULUS is basically a malware delivery buffet. It serves up ClickFix lures on fake landing pages, enticing unsuspecting users to run malicious commands on their own machines. Yes, you heard that right—people are voluntarily inviting malware to their computers.
Security researcher Sai Molige described ROMULUS as potentially a privately-operated panel, a criminal delivery service, or an affiliate framework. Or maybe it’s just a hacker's version of the neighborhood pizza delivery service—only instead of pepperoni, they deliver malware.
Forescout’s cyber sleuths managed to identify six IP addresses associated with this lovely platform:
- 96.62.224[.]81
- 86.109.75[.]7
- 151.240.151[.]223
- 23.94.145[.]224
- 93.152.224[.]118
- 2.27.248[.]127
The star of the show, 96.62.224[.]81, has hosted a ClickFix script and even has an MSI installer file linked to another campaign that uses malicious ChatGPT Custom GPTs. Who knew AI would be this relatable—also leading people to scams?
Forescout found this malware being delivered through another server, 86.109.75[.]7, which hosted a panel called, wait for it, ROMULUS. This panel has also been known to run PowerShell scripts that deliver Legion Loader—also known as the malware equivalent of a Swiss Army knife.
As of now, the mystery of who’s behind ROMULUS remains unsolved. However, it appears to have zero ties to the notorious RomulusLoader, which is a relief for anyone who thought this was yet another plot twist in the ongoing saga of malware families.
The platform has two endpoints designed to download a PowerShell script. This script—a digital gatekeeper—decides which prize you get to download next: a trojanized MSI installer packed with malware, or an encrypted archive of Legion Loader inflated to nearly 1 GB. Why such a big file? To bypass upload limits, of course! Because why not make things more complicated?
The findings underscore how ClickFix is evolving from a mere social engineering trick into a fully-fledged malware distribution system. So if you feel like taking your cybersecurity game up a notch, maybe start looking out for those suspicious PowerShell commands and DLL sideloading events.
In the meantime, if you find yourself on a questionable website and they offer you the chance to "download the coolest new software," maybe just hit the "no thanks" button. Your computer will thank you later.
