The newly identified ROMULUS platform is being utilized by cybercriminals to deploy malware through a mechanism known as ClickFix. This platform combines concealed PowerShell scripts, modified software installers, and encrypted archives to execute its operations. ROMULUS facilitates multiple infection paths, one of which deploys LegionLoader, while another exploits an authentic Stardock application to introduce malicious code.
ROMULUS: A Versatile Delivery System
Research highlights that a unified delivery system like ROMULUS can distribute diverse malware packages while masking activities behind trusted utilities. ClickFix persuades users to execute commands, often through deceptive verification prompts or repair instructions, transforming a simple browser interaction into the onset of a Windows system infection.
Forescout’s Vedere Labs uncovered ROMULUS during an independent investigation, with their analysis published on October 15, 2026. During their research, they identified six IP addresses linked to the same login panel, examining two distinct delivery chains. The operators remain unidentified, and there is no evidence linking ROMULUS to the previously reported RomulusLoader.
Uncovering ROMULUS’s Functionality
The platform was connected to a package previously identified by Huntress, which had been involved in a campaign exploiting ChatGPT Custom GPTs. These earlier activities used AI-generated pages to reroute visitors into ClickFix traps. ROMULUS appears to serve as a reusable backend delivery system, rather than a single-use server for a specific malware payload.
ROMULUS employs twelve-character tokens to fetch either PowerShell staging scripts or malicious MSI installers. Researchers could not establish whether these tokens identify victims, campaigns, assignments, or delivery jobs.
Technical Details and Implications
Both recovered scripts from ROMULUS utilized similar designs, reconstructing hidden code from extensive numeric arrays before executing it through PowerShell. Each script self-deleted after execution. The first infection path downloaded an MSI using a decimal IP address, stored it in a temporary folder, and executed it silently with Windows Installer.
The second path concealed its PowerShell activity and downloaded an encrypted archive with the legitimate 7-Zip command-line utility. The layered, password-protected archives hid filenames and contents, evading detection by scanners without the password. This sophisticated approach expanded a small archive into a large file, circumventing upload limits and scanning thresholds.
LegionLoader played a crucial role, registering infected systems, receiving commands, supporting PowerShell execution, and downloading additional payloads. It accessed Chrome Local State key material to collect sensitive browser information, utilizing RC4 encryption and Base64 encoding for command communications.
Enhancing Cybersecurity Measures
Forescout advises security teams to scrutinize PowerShell script logs, silent MSI installations from temporary folders, unusual DLL loads, and oversized executables. Comprehensive network visibility is essential for detecting form requests containing Base64 blobs. Users should close verification pages prompting command execution, and security teams should review files bypassed due to size limits.
While ROMULUS’s direct connection to the previously analyzed stager remains unconfirmed, the investigation provides critical indicators for cybersecurity professionals to track and mitigate the platform’s impact. As new malware tactics emerge, it is imperative for defenses to adapt swiftly, integrating threat intelligence feeds from global sources.
