ROMULUS: Forescout finds a shared ClickFix delivery panel on six servers pushing sideloaded Stardock/Canon installers and LegionLoader inside archives padded to about 842 MiB to beat scanners
Forescout Research – Vedere Labs published an analysis on 15 October 2026 of ROMULUS, a web panel it found while investigating an incident that works as a reusable backend for ClickFix lures, the fake pages that trick people into pasting and running a command themselves. Forescout identified six IP addresses running ROMULUS. One server delivered the same trojanised Stardock DeElevation installer that Huntress reported on 28 September in a campaign using ChatGPT Custom GPTs to send victims to ClickFix pages. A second route runs a hidden PowerShell staging script that downloads the legitimate 7zr.exe from GitHub and a password-protected 7z archive from orbitflownetwork[.]lol, then unpacks an executable inflated to about 842 MiB, apparently to exceed upload and scanning size limits, which carries encrypted shellcode and LegionLoader, a loader active since 2019 (also called CurlyGate, RobotDropper and Satacom) that fetches further payloads. Forescout does not know who runs ROMULUS and says it may be a private panel, a criminal delivery service, an affiliate framework or copied software; it says it has no link to the RomulusLoader malware Proofpoint tied to Silver Fox earlier this year. Primary: Forescout; wires: Infosecurity Magazine, The Hacker News.
- Product
- Windows endpoints — users tricked into running PowerShell via ClickFix lures
- Versions
- n/a — malware delivery infrastructure
- Exploited in Australia?
- unknown
- Patch to
- Block the six ROMULUS IPs and orbitflownetwork[.]lol listed by Forescout. Restrict the Run dialog and PowerShell for standard users, alert on hidden PowerShell windows that download 7zr.exe or password-protected archives, and on unusually large executables written to user folders. Hunt for DLL sideloading from freshly installed MSI packages, and teach staff that real sites never ask them to paste commands to 'verify' or 'fix' something.
Primary: Forescout Vedere Labs — ROMULUS: Analysis of a new multi-payload ClickFix delivery platform (15 Oct 2026) · The Hacker News — Hackers use new ROMULUS ClickFix platform to deliver LegionLoader (20 Oct 2026)