ROMULUS ClickFix: How a New Malware Delivery Platform Is Turning Users Into Their Own Worst Enemy
Executive Summary
In October 2026, cybersecurity researchers at Forescout Vedere Labs disclosed ROMULUS, a multi-payload ClickFix delivery platform distributing malware including LegionLoader (also known as Satacom, CurlyGate, and RobotDropper). ROMULUS operates by luring victims to fraudulent landing pages that instruct them to execute malicious PowerShell commands, triggering a staged infection chain. The platform delivers either trojanized MSI installers or encrypted, padded archives exceeding 1 GB designed to evade sandbox analysis. Six active IP addresses were identified, one linked to a prior campaign abusing ChatGPT Custom GPTs. The attributed operators remain unknown, though ROMULUS shares no overlap with China-aligned Silver Fox threat actor infrastructure.
ROMULUS signals a significant evolution in ClickFix from a standalone social engineering trick into a scalable, commoditized malware-as-a-service delivery framework. The use of padded payloads to defeat sandboxes, multi-stage PowerShell loaders, and potential affiliate or commercial panel structures mirrors the professionalization trend seen in ransomware ecosystems, raising the risk profile for enterprises across all sectors.
Why This Matters Now
ClickFix-based attacks surged throughout 2025–2026 as attackers discovered that tricking users into self-executing malicious commands bypasses most endpoint defenses. ROMULUS commoditizes this technique into a distributable platform, potentially enabling dozens of threat actors to launch simultaneous campaigns with minimal technical overhead. With LegionLoader capable of fetching secondary payloads including infostealers and RATs, organizations face compounding downstream risk from a single initial compromise.
Attack Path Analysis
The ROMULUS ClickFix platform lured users to bogus landing pages — including those masquerading as ChatGPT Custom GPTs — where social engineering tricks induced victims to manually execute malicious PowerShell commands, establishing the initial foothold. From there, the loader (Legion Loader / Satacom) contacted remote C2 servers to retrieve additional payloads, enabling persistent attacker control, potential lateral movement within compromised environments, and downstream data exfiltration or ransomware-style impact.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Victims were directed to attacker-controlled landing pages hosting ClickFix-style lures — including fake ChatGPT Custom GPT interfaces — where they were socially engineered into manually running malicious PowerShell commands. The PowerShell staging script then fetched either a trojanized MSI installer or an encrypted archive containing Legion Loader, inflated to ~1 GB to evade sandbox analysis. CNSF Cloud Firewall (ACF) and Inline IPS (Suricata) capabilities could have blocked outbound connections to known malicious IP addresses (e.g., 96.62.224[.]81, 86.109.75[.]7) and detected known malware delivery signatures in the download traffic.
MITRE ATT&CK® Techniques
User Execution: Malicious File
Command and Scripting Interpreter: PowerShell
Phishing: Spearphishing Link
Obfuscated Files or Information: Binary Padding
Hijack Execution Flow: DLL Side-Loading
Ingress Tool Transfer
System Binary Proxy Execution: Msiexec
Web Service
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection
Control ID: SI-3
CISA Zero Trust Maturity Model 2.0 – Application-Level Behavioral Monitoring
Control ID: Application Pillar - Visibility & Analytics
NIS2 Directive – Incident Handling and Malware Defense
Control ID: Article 21(2)(e)
PCI DSS 4.0 – Anti-Malware Mechanisms and Behavioral Detection
Control ID: Requirement 5.2
DORA (EU Regulation 2022/2554) – Threat Detection and Anomaly Monitoring
Control ID: Article 10 - ICT-related Incident Detection
NYDFS 23 NYCRR 500 – Endpoint and Script Execution Monitoring
Control ID: Section 500.14 - Monitoring the Activity of Authorized Users
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
ROMULUS ClickFix platform delivers LegionLoader via malicious PowerShell and trojanized MSI installers, exploiting IT environments lacking east-west segmentation, egress controls, and inline IPS signature coverage against malware delivery chains.
Financial Services
LegionLoader and secondary payload deployment via ClickFix lures threatens financial institutions with credential theft and lateral movement, violating PCI 4.0 and NIST 800-53 egress and segmentation compliance mandates.
Health Care / Life Sciences
ROMULUS malware loader campaigns targeting end-users risk PHI exfiltration and unauthorized system access, directly implicating HIPAA 164.312 controls around encrypted transit, anomaly detection, and east-west traffic segmentation.
Computer Software/Engineering
Trojanized MSI installers and ChatGPT Custom GPT lures used by ROMULUS specifically exploit software engineers' tool-trust behaviors, enabling loader execution and DLL sideloading within development and cloud-native pipeline environments.
Sources
- Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malwarehttps://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.htmlVerified
- ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platformhttps://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/Verified
- LegionLoader / Satacom Downloader Malware Analysishttps://thehackernews.com/2023/06/new-malware-campaign-leveraging-satacom.htmlVerified
- Attackers Abuse ChatGPT Custom GPTs to Deliver ClickFix Malwarehttps://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- An Emerging Silver Fox-Like Cluster: PaperMillhttps://www.jumpsec.com/guides/an-emerging-silver-fox-like-cluster-papermill/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
The ROMULUS ClickFix campaign exploited user-initiated PowerShell execution to establish footholds and deploy Legion Loader across cloud-connected environments, making Aviatrix Zero Trust CNSF directly relevant through its ability to constrain outbound staging connections, restrict east-west reachability, and reduce the blast radius of any compromised workload. By enforcing identity-aware segmentation and controlled egress policies across the fabric, Aviatrix would likely limit how far an attacker could move after initial execution and reduce the viable outbound paths available for C2 communication and data exfiltration.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connections from workloads to known malicious staging infrastructure would likely be intercepted and blocked before payload delivery completes, reducing the attacker's ability to successfully fetch and stage the Legion Loader binary onto the compromised host.
Control: Zero Trust Segmentation
Mitigation: Even if privilege escalation succeeds on the host itself, Zero Trust Segmentation would likely constrain the elevated session's reachability across the broader cloud environment, reducing the scope of what an attacker could access from that escalated position.
Control: East-West Traffic Security
Mitigation: East-west enforcement would likely limit the attacker's ability to reach adjacent workloads or cloud segments from the compromised host, reducing the number of viable pivot paths available and constraining lateral spread across the environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the multicloud environment would likely surface anomalous outbound beaconing patterns to unauthorized external destinations, enabling policy-driven responses that could disrupt the attacker's ability to reliably maintain C2 communication and retrieve further payloads.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based egress filtering and outbound policy enforcement would likely reduce the attacker's viable exfiltration paths to external infrastructure, constraining unauthorized data transfers before they reach attacker-controlled endpoints.
If earlier segmentation and egress controls constrained the attacker's movement and communication paths, the residual impact would likely be limited to the initially compromised workload or a narrow set of reachable resources, reducing the risk of ransomware propagating across cloud segments or credential theft scaling to broader identity infrastructure.
Impact at a Glance
Affected Business Functions
- End-User Workstation Security and Endpoint Integrity
- Corporate Credential and Identity Management
- Data Loss Prevention and Sensitive Data Handling
- IT Security Operations and Incident Response
Estimated downtime: 7 days
Estimated loss: N/A
Victims who execute the ClickFix-delivered PowerShell commands risk full endpoint compromise via LegionLoader, which fetches and runs secondary payloads of the operator's choosing. Likely data exposure categories include browser-stored credentials, session cookies, cryptocurrency wallet data, corporate authentication tokens, and potentially sensitive documents accessible from the compromised workstation. Because ROMULUS functions as a multi-payload delivery framework, the downstream payload is variable and could include infostealers, ransomware precursors, or remote access trojans such as ValleyRAT or DcRAT, significantly broadening the data exposure surface. No confirmed victim count or specific breach records have been publicly disclosed at time of writing.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Firewall (ACF) with FQDN-based egress filtering and block outbound connections to known ROMULUS-associated IP addresses (96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, 2.27.248[.]127) to prevent PowerShell staging script retrieval and C2 beaconing at the network layer.
- • Enable Inline IPS (Suricata) with up-to-date signatures covering ClickFix delivery patterns, malicious MSI installers, Legion Loader traffic, and oversized archive download anomalies to detect and block malware delivery before payload execution.
- • Enforce Zero Trust Segmentation with least-privilege, identity-based policies and microsegmentation across workloads to prevent post-compromise lateral movement by Legion Loader-deployed RATs (ValleyRAT, DcRAT, Venom RAT) from reaching sensitive cloud segments.
- • Activate Multicloud Visibility & Control with centralized traffic observability to baseline normal outbound communication patterns and alert on anomalous C2 beaconing, repeated staging script downloads, or suspicious PowerShell-initiated network flows across hybrid and multi-cloud environments.
- • Leverage Egress Security & Policy Enforcement with outbound FQDN allowlisting and data loss prevention controls to block unauthorized data exfiltration channels established by loader-deployed payloads, ensuring only approved application-to-internet traffic is permitted.
