{
  "id": 15698821,
  "title": "Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware",
  "url": "https://urgent.news/2026/10/20/hackers-use-new-romulus-clickfix-platform-to-deliver-legionloader-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T04:05:58.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html"
  },
  "original_language": "en",
  "account": "Cybersecurity experts have uncovered information about a new ClickFix platform named ROMULUS, which is being utilized to disseminate malware like Legion Loader. Vedere Labs, a research firm, explains that ROMULUS operates like a malware delivery service, employing deceptive lure tactics to coax users into executing malicious commands and infecting their devices. Romige, a security researcher, suggests that ROMULUS might be a privately managed panel, a commercial cybercrime delivery service, an affiliate network, or simply copied software among operators. The cybersecurity company has identified six IP addresses running ROMULUS, including 96.62.224[.]81 and 86.109.75[.]7, which have been linked to campaigns using malicious ChatGPT Custom GPTs and ClickFix lure tactics. The malware delivered through this platform can also include Legion Loader, also known as Satacom downloader, CurlyGate, and RobotDropper. While the identity of the ROMULUS platform's operators remains unknown, it bears no resemblance to RomulusLoader, a malware family tied to the China-aligned Silver Fox threat actor. ROMULUS exposes two endpoints responsible for downloading a PowerShell staging script, which determines the subsequent payload, whether it's a trojanized MSI installer or an encrypted archive containing Legion Loader. The loader communicates with a remote server to download further payloads. This revelation highlights how ClickFix is transforming from a social engineering technique into a potent malware delivery mechanism. To counter this threat, it is crucial to monitor for suspicious PowerShell commands and DLL sideloading activities.",
  "summary": "Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own",
  "key_points": [
    "ROMULUS ClickFix platform used to deliver malware like Legion Loader",
    "Vedere Labs identifies six IP addresses running ROMULUS",
    "ROMULUS transforms ClickFix from social engineering to potent malware delivery"
  ],
  "editors_take": "The emergence of ROMULUS signals the evolution of ClickFix from a simple social engineering tactic into a sophisticated, automated infrastructure for distributing diverse malware payloads to unsuspecting users.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}