Security teams are facing a new threat dubbed ROMULUS ClickFix, a delivery platform uncovered by Forescout’s Vedere Labs on October 15, 2026. It combines deceptive ClickFix techniques with hidden PowerShell scripts, altered software installers, and encrypted archives to distribute malware in ways that dodge conventional detection. The platform supports multiple infection paths—one leading to LegionLoader, another abusing a legitimate Stardock program—making it a versatile tool for attackers.
How ClickFix Traps Users
ROMULUS uses ClickFix-style deception, tricking users into executing commands via fake verification prompts or repair instructions. Once a user is lured into visiting the malicious page, that’s enough to initiate a Windows infection chain. This method was linked to earlier campaigns using malicious ChatGPT Custom GPTs, which directed visitors to ClickFix portals—pointing to ROMULUS as a reusable, backend delivery mechanism rather than a one-off attack tool.
Multi-Path Infection Strategies
The researchers examined two specific delivery routes. The first uses a PowerShell staging script to fetch a Windows Installer (.MSI) package via an IP address hidden in decimal form. It saves this installer in the temporary folder, removes download restrictions, and silently installs it using the Windows Installer service. That package masquerades as Stardock’s Smart DeElevation Tool, and it sideloads a patched DLL that then loads a malicious loader.
The second route conceals its operations through encrypted archives and dual-stage unpacking. Using 7-Zip command-line tools, a password-protected archive wraps another one, whose contents aren’t visible without the correct password. Inside: a large executable padded during compilation (to avoid size-based detection limits), which eventually loads LegionLoader via two unpacking layers involving AES encryption and reversed byte sequences.
LegionLoader and Evasion Techniques
LegionLoader, deployed via ROMULUS, registers compromised machines, executes commands via PowerShell, and pulls in extra payloads. It also steals sensitive browser information—specifically Chrome Local State key material—and communicates using RC4 encryption and Base64-encoded forms disguised as routine web traffic. These steps help evade detection by blending in with normal system behavior.
Defender Guidance & Indicators of Compromise
Forescout’s scientists suggest defenders watch for signs like PowerShell script logs showing self-deleting behavior, silent MSI installs from temporary directories, unusual DLL loading, and oversized executables. Network logs showing form requests that include Base64 blobs instead of expected field patterns may also reveal surreptitious activity.
Notable network indicators include IP addresses and compromised delivery domains—some housed under decimal-formatted addresses—as well as archive names, MSI filenames, and command-and-control endpoints like “smashshape[.]com”. Forensic analysts can use SHA-256 hashes listed in the report to verify malware files or staging artifacts.
ROMULUS is yet to be tied to any known threat actor group, and researchers have found no link to the previously known RomulusLoader. Whether ROMULUS serves as a private tool, a criminal service, or a collaborative asset remains undetermined—but its modular delivery architecture suggests a scalable design.
For organizations still relying on signature-based protection or scanned artifacts alone, ROMULUS ClickFix highlights a gap in security posture. Detection must combine behavioral analysis, telemetry from script execution, installer behavior, and network traffic analysis. Regular review of large or password-protected archives, verification prompts, and IP/domain anomalies is increasingly crucial.
ROMULUS ClickFix represents a dangerous evolution in malware delivery: it layers deception, encryption, and trusted software abuse to stay under the radar. It’s a reminder that attackers are blending user-manipulated steps (like fake prompts) with deeply hidden back-end stages. Organizations should prioritize visibility across the full attack chain, looking beyond static files to execution paths, network indicators, and privilege escalations.
