Security analysts have uncovered a new campaign leveraging a platform called ROMULUS that delivers malware—such as Legion Loader—via deceptive ClickFix-style lures. ROMULUS operates through fake landing pages that trick users into executing commands that ultimately compromise their systems. The activity was detailed in research from Forescout/Vedere Labs.
What is ROMULUS and how it works
ROMULUS is being used as a malware dropper platform, confusing victims with trick pages that mimic technical fixes (so-called “ClickFix” scams). Once a target interacts, stages of infection begin: a URL leads to a staged PowerShell script or MSI installer which then fetches either a malicious loader or an encrypted archive containing the Legion Loader payload.
The loader establishes contact with command-and-control servers to download additional malware. In one case tied to IP 96[.]62.224[.]81, researchers found both the ClickFix script and an MSI installer, along with misuse of custom AI tools to redirect users to these bogus URLs. A second server at 86[.]109.75[.]7 hosted the ROMULUS panel driving a similar scheme.
Legion Loader and other threats involved
Legion Loader—also known under names like Satacom downloader, CurlyGate, and RobotDropper—is the primary payload delivered. In one chain, the fake ClickFix lure triggers a PowerShell script which then loads Legion. Other methods include deploying trojanized MSI installers via ROMULUS.
IP addresses involved in the campaign include: 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, 93.152.224[.]118, and 2.27.248[.]127. One IP, 96.62.224[.]81, was further linked to a campaign using a custom builds of AI agents to point victims to the malicious domains.
Though ROMULUS belongs to the malware infrastructure ecosystem, it has no known ties to RomulusLoader, a different threat linked to the Silver Fox (TA4922) group. Silver Fox has been associated with remote access trojans and DLL sideloading tricks via tax-themed lure campaigns, but the current ROMULUS activity appears unrelated.
Detection and mitigation strategies
The evolving ClickFix approach, as used by ROMULUS, demonstrates how social engineering is being paired with technical chain-execution to more reliably breach systems. Because the workflow involves staged PowerShell scripts and MSI installers, defenders should monitor for abnormal PowerShell executions and unsigned or unexpected MSI activity. DLL sideloading—where a legitimate executable is tricked into loading a malicious DLL—should also be flagged as suspicious.
Network observability tools may help identify communication with unusual command-and-control servers originating from endpoints. Incident responders should correlate suspicious downloads and post-execution callbacks to trace the infection path.
As yet, the individuals or groups operating ROMULUS have not been identified. It could be run by a private criminal service, affiliate network, or be software that is shared or sold across multiple actors, according to analysis.
What this means for broader cyber-crime trends
ROMULUS shows how threat actors are refining their toolkit—turning social engineering tools like ClickFix lures into platforms that operationalize malware delivery. This raises the bar for detection. Organizations and users must assume that any suspicious MSI or PowerShell prompt could be an entry point. Vigilance over endpoint behavior, network calls, and filesystem anomalies is critical. Watch for emerging patterns in how ROMULUS spreads and whether its operators build partnerships or affiliate models that scale its reach.
