Cybersecurity researchers at Forescout Research - Vedere Labs have identified a new malware delivery platform named ROMULUS that uses ClickFix-style attacks to distribute Legion Loader and other malware.
ROMULUS operates as a malware delivery service. It deploys fake landing pages designed to trick users into executing malicious commands that infect their systems. The platform uses ClickFix lures, a social engineering technique that mimics legitimate software update or security warning prompts to convince victims to run attacker-controlled code.
Legion Loader serves as one of the payloads distributed through ROMULUS, though researchers identified additional malware variants delivered via the platform. The ClickFix approach represents a shift in delivery tactics, moving away from traditional email phishing or exploit kit methods toward browser-based social engineering that preys on user trust in legitimate-looking notifications.
Forescout Research - Vedere Labs released the technical findings after observing ROMULUS in active distribution campaigns. The platform's design as a malware-as-a-service delivery infrastructure suggests organized cybercriminal operations behind its development and operation.
Users remain vulnerable to ROMULUS attacks if they trust deceptive landing pages that impersonate legitimate software vendors or security platforms. Clicking through these fake prompts and executing suggested commands directly compromises system integrity.
Organizations should educate staff on recognizing ClickFix social engineering attacks and verify software updates through official vendor channels rather than responding to unsolicited browser notifications or alerts from unknown sources. Endpoint detection and response tools can help identify suspicious command execution patterns typical of these attacks.