Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

ROMULUS ClickFix Panel Found Powering Multi-Payload Malware Delivery

Researchers at Forescout Research - Vedere Labs have disclosed a previously unknown malware-delivery-as-a-service platform called ROMULUS that uses ClickFix-style lure pages to trick victims into infecting their own machines. The platform was found distributing Legion Loader (also tracked as Satacom downloader, CurlyGate, and RobotDropper) alongside trojanized MSI installers, and researchers have since tied its infrastructure to active exploitation of a Siemens Software Center flaw, CVE-2026-110936.

Forescout researcher Sai Molige discovered the ROMULUS admin panel while investigating an unrelated incident, then traced the same login interface to six separate servers, indicating the backend is reused across multiple campaigns rather than built for a single operation.

Details

What Happened

Forescout's Vedere Labs team uncovered ROMULUS while responding to an unrelated security incident and found a server hosting an authentication panel for the platform. Pivoting on infrastructure fingerprints, analysts identified six IP addresses — 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, and 2.27.248[.]127 — all exposing the same login interface, suggesting ROMULUS is operated as a reusable delivery backend rather than a one-off malware drop server.

One exposed statistics dashboard gave researchers visibility into how operators track campaign performance, logging unique installs, total execution runs, a rolling 14-day history, and victim countries — the kind of telemetry normally reserved for legitimate software analytics, repurposed for measuring infection success.

Researchers also connected one of the six IPs, 96.62.224[.]81, to a separate campaign previously documented by Huntress that abused malicious ChatGPT Custom GPTs to redirect victims toward fake pages serving ClickFix lures, and which leveraged signed binaries from Canon and Stardock for DLL sideloading across at least 40 reported incidents. Days after Forescout's disclosure, Siemens confirmed that attackers had bundled a legitimately signed copy of its Software Center utility (version 3.5.8.7) with malicious DLLs exploiting CVE-2026-110936 — an improper DLL search-path validation flaw — and linked the distribution server to ROMULUS infrastructure. Siemens shipped a fix in version 4.0.9.8 on October 17 and confirmed active exploitation on October 19; no Siemens-owned systems or official distribution channels were compromised.

How It Works

Stage 1 — The ClickFix lure. Victims land on a bogus page — often reached via malicious search ads, compromised sites, or the AI-chatbot redirect chain tied to fake ChatGPT Custom GPTs — presenting a fake human-verification or CAPTCHA prompt. Instead of a simple checkbox, the prompt instructs the user to open the Windows Run dialog or a terminal and paste a "verification" command that has already been copied to their clipboard.

Stage 2 — Token-based staging endpoints. The pasted command reaches one of two ROMULUS endpoints, each referenced by a twelve-character token. Forescout could not confirm whether the tokens identify individual victims, campaigns, affiliates, or delivery jobs, but the endpoints consistently return either a PowerShell staging script or a malicious MSI installer. Both recovered PowerShell scripts shared the same obfuscation design — reconstructing concealed code from large arrays of numbers before executing it, then deleting themselves on exit to limit forensic artifacts.

Stage 3 — Two divergent payload routes.

• Trojanized installer route: a tampered Stardock DeElevation MSI bundles a legitimate, signed application with a malicious DLL. When the signed executable loads, it sideloads the attacker's DLL from the same directory, inheriting trust from the legitimate binary — the same technique later confirmed in the Siemens Software Center incident.
• Legion Loader route: the staging script instead delivers an encrypted archive that unpacks into an executable artificially inflated to roughly 842 MiB from an original archive smaller than 1 megabyte. The padding is designed to push the extracted file past the size limits many sandboxes and antivirus engines apply before scanning.

Stage 4 — Legion Loader execution. Legion Loader has been active since 2019 and supports encrypted command-and-control communications, on-demand delivery of additional payloads, arbitrary PowerShell execution, persistence mechanisms, and theft of Chrome browser data — including encryption keys, profile data, and browsing history — giving operators a path to credential theft well beyond the initial infection.

Forescout found no code or infrastructure overlap between ROMULUS and the unrelated RomulusLoader malware family tied to the Silver Fox (TA4922) threat cluster. Molige noted that ROMULUS "may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators" — leaving attribution open.

Impact Assessment

Recommendations

For IT Admins

• Audit for DLL sideloading opportunities in signed, frequently distributed applications (installers, utilities, update tools) where a malicious DLL could be dropped alongside a trusted executable
• Apply the Siemens Software Center 4.0.9.8 update immediately if any legacy 3.5.8.7 installations remain in the environment
• Block or alert on outbound connections to the six identified ROMULUS IPs: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, and 2.27.248[.]127
• Review how security tooling handles encrypted archives and oversized executables — confirm that scanning limits are not silently skipping files above common size thresholds

For Security Teams

• Hunt for PowerShell executing reconstructed code from numeric arrays, followed by the script deleting itself — a distinctive ROMULUS staging pattern
• Monitor for MSI installations immediately followed by DLL loads from non-standard or user-writable directories (classic sideloading sequence)
• Treat ClickFix-style "verify you are human" prompts that request a paste-and-run action as a high-confidence indicator of compromise, not a nuisance pop-up
• Correlate web proxy/DNS logs for visits to AI-chatbot redirect chains (including spoofed ChatGPT Custom GPT pages) that forward to unfamiliar verification domains

For End Users

• Never paste clipboard content into the Run dialog, PowerShell, or a terminal because a website told you to — no legitimate CAPTCHA or verification step requires this
• Close the browser tab and report the page to IT/security if a "human verification" prompt asks you to run a command
• Be skeptical of AI chatbot results that redirect to unfamiliar download or verification pages, even when the chatbot itself appears legitimate

Key Takeaways

1. ROMULUS is infrastructure, not a single campaign — six servers running an identical panel point to a reusable delivery backend shared across operators or affiliates
2. ClickFix keeps escalating — from simple infostealer lures to a multi-payload platform capable of delivering trojanized installers and a mature loader like Legion Loader
3. File-size padding is a deliberate evasion technique — inflating an executable to roughly 842 MiB from under 1 MB is designed to exceed scanning limits, not just obfuscate code
4. Trusted software is the delivery vehicle — Stardock, Canon, and now Siemens binaries have all been abused for DLL sideloading in connected campaigns
5. Attribution remains unresolved — Forescout explicitly ruled out overlap with RomulusLoader/Silver Fox, leaving the operators behind ROMULUS unidentified
6. Real-world consequences are already confirmed — the Siemens Software Center exploitation (CVE-2026-110936) shows ROMULUS-linked infrastructure actively feeding live intrusions, not just research findings

Sources

• Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware — The Hacker News
• ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads — Infosecurity Magazine
• Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks — SecurityWeek