ROMULUS ClickFix panel used to distribute Legion Loader
Forescout Research - Vedere Labs has identified ROMULUS, a ClickFix delivery platform used to distribute malware including Legion Loader. The researchers found six IP addresses running the infrastructure: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118 and 2.27.248[.]127.
ROMULUS uses bogus landing pages and ClickFix-style lures to persuade users to execute malicious commands on their own machines. Forescout researcher Sai Molige said the operation may be a privately run panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied among operators.
ClickFix as a malware delivery layer
ClickFix lures are designed to turn user interaction into the initial execution step. In the ROMULUS chains examined by Forescout, a victim-triggered sequence can run a PowerShell script and deliver Legion Loader, which is also known as Satacom downloader, CurlyGate and RobotDropper.
One identified server, 96.62.224[.]81, had previously hosted a ClickFix script and an MSI installer in a campaign that used malicious ChatGPT Custom GPTs to direct victims to a fake URL. Forescout subsequently found the same malware served through 86.109.75[.]7, which also hosted a panel named ROMULUS.
The broader pattern aligns with ClickFix chains and growing AI agent incidents as ClickFix chains increasingly combine social engineering with executable delivery mechanisms.
Staging endpoints choose the next payload
ROMULUS exposes two endpoints intended to download a PowerShell staging script. That script determines the next payload to retrieve: either a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader.
Once installed, the loader communicates with a remote server to obtain and run additional payloads. This makes the initial ClickFix interaction an entry point rather than the end of the infection sequence, allowing later-stage content to be fetched after execution.
No confirmed attribution
Forescout said it is not known who operates ROMULUS. The platform has no identified overlap with RomulusLoader, a separate malware family linked to Silver Fox, also known as TA4922. That China-aligned actor has repeatedly used tax-related lures to spread remote-access trojans including ValleyRAT, also called Winos 4.0, DcRAT and potentially Venom RAT through DLL sideloading techniques.
For businesses, the immediate implication is to treat suspicious instructions that ask staff to copy, paste or run commands as a security event. Teams should hunt for unusual PowerShell commands and DLL sideloading activity, then investigate the delivery chain and any subsequent payload retrieval.