Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers from Forescout Research - Vedere Labs have disclosed details of a new malware delivery platform called ROMULUS that uses ClickFix-style lures. The platform operates as a malware-as-a-service, using fake landing pages to trick users into executing malicious commands on their own machines. ROMULUS is being actively used to distribute malware including Legion Loader. The ClickFix technique involves social engineering users into running malicious commands by presenting fake error messages or verification prompts. This platform represents a growing trend of commoditized malware delivery services that lower the barrier to entry for threat actors. The use of bogus landing pages makes attribution and detection more challenging for defenders.