- Forescout's Vedere Labs found ROMULUS, a reusable ClickFix delivery platform, on six servers. It can deliver different kinds of malware to victims.
- ClickFix works because a trusted user runs the attacker's commands, so security controls often do not step in.
- Leaders should ask whether staff can run pasted commands at all, and whether their tools can inspect very large files.
ClickFix works because the victim does the attacker's job. A real, signed-in employee runs the commands. To the computer, that looks like an authorised person doing normal work. Security controls often stay quiet. A new Forescout finding shows this trick being packaged for reuse.
What the researchers found
Analysts at Vedere Labs, part of Forescout Research, published their findings on October 14. They were investigating an incident when they found a server hosting a panel called ROMULUS. The same malware had been delivered by a separate ClickFix campaign. It was also tied to another server in the incident.
Further analysis showed ROMULUS to be a new, multi-payload, shared ClickFix delivery platform. Infosecurity Magazine reported the findings. In plain terms, one system can hand out different kinds of malware through different routes.
From a one-off trick to a reusable platform
The researchers describe ROMULUS as a reusable delivery backend. It is not a single hard-coded malware server. They say this suggests use at scale.
Six servers run it. The researchers say that could mean the infrastructure works as a toolkit for a wide range of cybercriminals. That is their reading, not a proven fact.
Picture a shared warehouse that ships whatever each customer sends. The warehouse does not care what is in the box. Here, the lure and the delivery machinery may be built once and reused. The malware on top can change.
The researchers also see ClickFix changing role. It began as a lure. They now view it as the first step in wider malware operations. They add that attackers are varying their delivery systems and hiding their activity. The report gives no figures on how many victims there are.
A file built to be skipped
ROMULUS also uses an unusual way to hide. One delivery route spread LegionLoader, a multi-pronged malware delivery platform, in encrypted archives. Inside each sat an executable inflated to about 842 MiB.
The researchers say this size could exceed the file-size limits of security scanning and analysis tools. A tool with such a limit may skip the file. That would let the malware pass unchecked.
What is still unknown
The operator behind ROMULUS is unknown. So is whether the final malware families share an owner. The platform is separate from RomulusLoader, a malware family Proofpoint researchers identified earlier in 2026.
That matters for planning. If many groups use one toolkit, tracking a single gang tells you less. The common thread would be the method, not the group.
Questions to put to your security team
First, can an ordinary employee run commands pasted from a web page at all? If so, ask who needs that ability and who does not. Test it rather than assume it.
Second, does awareness training describe this exact moment? A page that asks someone to copy, paste and run something is a different warning from a suspicious attachment.
Third, what do your scanning tools do with very large or encrypted files? Ask whether they block, skip or flag them. Ask who sees the result.
Fourth, who reviews the alert if a user-run command starts something unexpected? A control that sees an authorised user may stay silent unless someone has defined this case.
The lesson here is that the trusted user is now part of the attack path. ROMULUS suggests the delivery path may be built once and reused, possibly as a toolkit for many criminals. The operator is unknown. Defences that only ask whether the person is allowed may miss it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
