As reported by The Hacker News, Forescout's Vedere Labs has uncovered ROMULUS, a ClickFix delivery platform actively distributing Legion Loader and other malware families. While the individual techniques — fake CAPTCHA prompts, PowerShell staging, MSI abuse, and archive padding — are not novel in isolation, their assembly into a reusable platform represents a significant shift in how ClickFix campaigns are being operationalized.

Threat Alert: As reported by The Hacker News, Forescout's Vedere Labs has uncovered ROMULUS, a ClickFix delivery platform actively distributing Legion Loader and other malware families.

Why This Matters: From Tactic to Infrastructure

The most important takeaway from the ROMULUS disclosure is not the malware payload but the delivery model. ClickFix has existed for over a year as a social engineering technique: users are tricked into running PowerShell or terminal commands that they believe will fix a CAPTCHA, verify their identity, or install a needed plugin. What ROMULUS demonstrates is that this technique has now been productized.

Six IP addresses hosting the panel across multiple hosting providers suggests either a commercial offering or a privately operated infrastructure being reused by multiple operators. The fact that ROMULUS exposes only two endpoints — both serving PowerShell staging scripts — indicates the architecture is designed for simplicity and resale, not for sophistication. That is the real threat: low-skill operators can now rent or replicate a proven delivery mechanism that bypasses traditional perimeter controls entirely, because the victim executes the initial payload themselves.

The Self-Compromise Problem and Why Perimeter Defenses Fall Short

ClickFix campaigns succeed because they exploit the narrow gap between user action and automated defense. When a user manually runs a copied command in PowerShell, most endpoint protection platforms treat it as user-initiated activity. By the time behavioral engines flag suspicious child processes or network connections, the loader has already staged and may have fetched follow-on payloads.

ROMULUS compounds this with two evasions worth highlighting:

  • Payload inflation to ~1 GB — The encrypted archive containing Legion Loader is padded to nearly a gigabyte. This is a deliberate anti-analysis technique that exhausts sandbox memory budgets and discourages automated static scanning. Defenders relying on sandbox detonation with default resource limits will likely see incomplete analysis or timeouts.
  • MSI trojanization — By packaging the loader inside an MSI installer, ROMULUS leverages a signed, legitimate Windows installation format that many allowlists implicitly trust.

Who Is at Greatest Risk

ROMULUS targets end-user workstations, not servers. The most exposed organizations are those with:
  • Large non-technical user bases where ClickFix lures are more likely to succeed (customer support, sales, administrative staff)
  • Relaxed PowerShell execution policies (no constrained language mode, no script signing requirements)
  • Lightweight endpoint detection that may not catch LOLBin abuse and DLL sideloading

The connection to malicious ChatGPT Custom GPTs is especially notable — it means attackers are embedding delivery redirects inside AI assistant interactions, a vector most organizations have zero visibility into today.

What You Should Do — Shield53 Recommendations

Immediate Actions:

  • Block the six identified ROMULUS IPs at your perimeter and egress firewall: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, 2.27.248[.]127 — but treat this as temporary; infrastructure will rotate.
  • Hunt for PowerShell execution from clipboard or user-copied content — focus on powershell.exe launching from browser processes, rundll32.exe, or msiexec.exe with unusual parent chains.
  • Detect DLL sideloading events — look for legitimate signed executables loading DLLs from non-standard directories, especially in %APPDATA% or %TEMP%.
  • Enable PowerShell Constrained Language Mode for non-administrative users to limit what scripts can execute.
  • Review and restrict ChatGPT / AI tool access on managed endpoints until GPT marketplace monitoring matures.

Strategic Actions:

  • Add user security awareness content specifically covering ClickFix lures — show employees what fake CAPTCHA and verification prompts look like.
  • Configure sandbox analysis environments with elevated memory limits (4 GB+) to handle padded payloads and ensure complete detonation.
  • Deploy application allowlisting for MSI installations sourced from non-verified publishers.
  • Monitor for large (500 MB+) encrypted archive downloads following PowerShell execution events — this is a behavioral IOC specific to the ROMULUS delivery chain.

Bottom Line

ROMULUS is not a breakthrough in malware sophistication — it is a breakthrough in delivery-as-a-service. The technique that matters here is ClickFix, and it is only effective when users manually execute the initial compromise. That means the most durable control is not a firewall rule or an IOCs list; it is reducing the probability that a user copies and pastes an attacker's command into their terminal. Combine that user-level defense with PowerShell hardening and behavioral detection of the post-execution chain, and ROMULUS loses its advantage.