The ROMULUS ClickFix platform is a reusable malware delivery backend built to get you to infect your own Windows PC by pasting a single command. Researchers found six servers running it, and one of its delivery routes ends with LegionLoader hidden inside an 842 MiB file sized to slip past security scanners.
Key takeaways
- Forescout Research, Vedere Labs, disclosed ROMULUS in a blog post dated 15 October 2026, after spotting its panel during an unrelated incident investigation.
- ROMULUS serves PowerShell staging scripts and trojanized MSI installers through short tokenised links, and it ships more than one malware family.
- One route delivers LegionLoader, a loader active since 2019 that is also known as Satacom, CurlyGate and RobotDropper.
- The LegionLoader carrier is padded to 882,716,672 bytes, but almost all of that is filler that compresses to under 1 MB.
- Nobody knows who runs ROMULUS. It could be a private panel, a paid service or copied software.
What is the ROMULUS ClickFix platform?
ROMULUS is a web panel that attackers log into to manage infections. According to Forescout’s analysis by researcher Sai Molige, it has a dark-themed login page with a shield icon and a statistics page that counts “unique installs” and “all runs”, with a 14-day timeline and a breakdown by country.
Think of it as a parcel depot for malware. The victim’s machine shows up with a 12-character code, and the depot decides which package to hand over. Links of the form /s/<token> return a PowerShell script, while /app/<token> returns an MSI installer.
Forescout pivoted through VirusTotal and Shodan and found ROMULUS on six IP addresses. As Infosecurity Magazine reported, that spread hints the panel may be offered as a toolkit to more than one criminal crew.
How does a ClickFix attack trick you?
ClickFix is a social engineering trick. A fake page shows a “verification” step or an error, then tells you to press Win+R, paste a command and hit Enter. The page has already copied that command to your clipboard.
Because you run the command yourself, many browser and email defences never get a chance to step in. The technique is now huge. A CTM360 report covered by The Hacker News counted more than 17,000 infected URLs serving fake Cloudflare checks and cited Microsoft data putting ClickFix behind 47% of the initial-access cases its Defender Experts handled in 2025.
The lures don’t have to be crude, either. One server tied to ROMULUS also hosted files from a campaign Huntress documented in late September 2026, in which malicious ChatGPT Custom GPTs pointed people to a fake site carrying the ClickFix prompt.
Two routes, one panel: how ROMULUS delivers malware
Forescout analysed two tokens served from the same ROMULUS server in detail. They start the same way and end in very different places.
| Step | Route A: Stardock sideload | Route B: LegionLoader |
|---|---|---|
| First stage | PowerShell staging script | PowerShell script with a hidden window |
| Download | Trojanized MSI posing as the Stardock Smart DeElevation Tool | Password-protected 7z archive plus the real 7zr.exe from GitHub |
| Execution trick | A legitimate signed DeElevate64.exe loads a patched DLL (DLL sideloading) | Nested encrypted archives, then three in-memory decryption stages |
| Final payload | Multi-stage loader matching the Huntress Custom GPT campaign | LegionLoader, talking to smashshape[.]com |
DLL sideloading means dropping a malicious library next to a trusted, signed program so that the program loads it on launch. Your security tools see a legitimate app starting up. Three more tokens pointed to MSI files that Forescout did not analyse, so the menu is probably longer than two items.
Why is the LegionLoader file 842 MiB?
The executable weighs 882,716,672 bytes, yet the real code and encrypted data sit in the first 2 MB. Nearly all the rest is one section stuffed with a repeating 16-byte value.
It’s like posting a letter inside a fridge-sized box. Many scanners and sandboxes skip files above a size limit or run out of analysis time, so the bulk is the disguise. And since repetitive filler compresses to under 1 MB, the download stays small.
Once running, LegionLoader registers the machine using an ID derived from the disk’s volume serial, accepts PowerShell commands from its server, downloads more payloads and reads Chrome’s Local State file to get at stored browser data. Its job is to open the door for whatever comes next.
Who is behind ROMULUS?
Nobody knows. Forescout says ROMULUS may be a privately run panel, a commercial delivery service, an affiliate framework or software passed between operators. It also found no link to RomulusLoader, a different malware family tied to the China-aligned Silver Fox group, despite the similar name.
My read, and it is only opinion: a stats page counting installs by country looks like something built for customers to check their results, not for a single crew working alone.
How to spot and stop ROMULUS-style attacks
For most people, one rule covers it. No real website, CAPTCHA or support page will ever ask you to paste a command into the Run box, PowerShell or Terminal. If one does, close the tab.
For defenders, Forescout’s hunting list includes:
- PowerShell started from a browser, or run with
-w hidden,-ep bypassor-NoProfilealongside a URL. - URLs that use decimal IP notation, meaning 8 to 10 digits straight after http://.
- Silent MSI installs from %TEMP%, and 7zr.exe extracting password-protected archives.
- Huge executables in user folders, especially with a bloated .reloc section.
- POST requests to /nfront.php or /nback.php, and web traffic hitting /s/ or /app/ paths with 12-character hex tokens.
Turning on PowerShell script block logging (Event ID 4104) and blocking clipboard writes in managed browsers both shrink the target. Fake installers are a recurring theme: see how the GhostAction fake font stealer hit 94 GitHub repos, and how the Rank Math PRO backdoor showed that trusted plugin downloads can be turned against you too.
What happens next
Forescout published its indicators, including the six IPs, the domains orbitflownetwork[.]lol and smashshape[.]com, and file hashes, so security vendors can block what is known. But a reusable panel is cheap to move. Expect fresh servers, new tokens and new signed programs to abuse. The Huntress campaign had already swapped a Canon-signed executable for the Stardock one.
The bigger trend is that ClickFix has grown from a one-off scam into an entry point that whole criminal supply chains now plug into.
FAQ
Is ROMULUS the same as RomulusLoader?
No. Forescout found no overlap between the ROMULUS panel and RomulusLoader, a separate malware family linked to the Silver Fox group.
Does ROMULUS affect Macs?
The chains Forescout analysed target Windows, using PowerShell, MSI installers and Windows DLLs. ClickFix as a technique has also been used against macOS and Linux.
What should I do if I already pasted a command?
Disconnect from the network, run a full antivirus scan, change passwords from a different, clean device, and tell your IT team if it is a work machine. LegionLoader targets browser data, so treat saved passwords as exposed.
Next step: share the “never paste commands from a website” rule with your team, then check whether your endpoint tools alert on PowerShell launched from a browser.
Leave a comment