Kiran 
Forescout’s Vedere Labs has uncovered ROMULUS, a multi-payload ClickFix delivery panel that serves several malware chains from shared infrastructure.
The research, published October 15, 2026, shows how one backend can route victims to different loaders, including LegionLoader and a trojanized Stardock installer.
Researchers found ROMULUS while investigating an unrelated incident. The server at 86.109.75[.]7 delivered the same malware that Huntress reported on September 28 in a campaign abusing ChatGPT Custom GPTs. In that campaign, the GPTs sent victims to ClickFix lures hosted at 96.62.224[.]81.
ROMULUS ClickFix Platform Delivers
Forescout pivoted on VirusTotal and Shodan and found six IP addresses exposing the same dark-themed ROMULUS login page.
The page posts credentials to /api/login. One server also exposed a /stats.htm page showing unique installs, total runs, a 14-day timeline, and a country breakdown. Operators could use it to compare campaign reach.
ROMULUS uses two endpoints. The /s/<token> path serves a PowerShell staging script, and /app/<token> serves a trojanized MSI installer.
Tokens are 12-character hexadecimal strings. The variety of routes, with and without MSI files, suggests a reusable backend rather than a single hard-coded server. Many more tokens and MSI files appear on VirusTotal, suggesting active, large-scale use.
The staging scripts share one template. They are heavily obfuscated, rebuild their code from integer arrays, run it through a script block, and then delete themselves.
Token 19481b28bd67 downloads IconEdit2Turb.msi using a decimal IP address (1450003207) in the URL. The script retries up to three times, saves the file to %TEMP%, unblocks it and installs it silently with msiexec.
The MSI carries a legitimate DeElevate64.exe, which loads a patched DeElevator64.dll. That DLL pulls in the malicious I++u.dll loader. The later stages match Huntress’s description.
Token 6c67e0336a7b skips the MSI. Its script hides the PowerShell window and fetches an archive from orbitflownetwork[.]lol, plus the legitimate 7zr.exe from GitHub.
It extracts nested password-protected 7z files, using a password hardcoded in the script and a second one found in a text file.
The result is an executable of about 882 MB. Roughly 881.7 MB of that is repetitive padding in the .reloc section. The archive compresses to under 1 MB, yet the file can exceed upload limits and sandbox thresholds.
The real code sits in the first 2 MB. Stage 1 uses AES-256 to decrypt shellcode, and stage 2 repeats the decryption and manually maps a 475,648-byte PE. That final PE is LegionLoader, a loader active since 2019 and also tracked as CurlyGate, RobotDropper, and Satacom.
The configuration points to smashshape[.]com, with /nfront.php for registration and tasking and /nback.php for results. Traffic claims a form-urlencoded content type, but the body is one Base64 string of RC4-encrypted binary data, using a 31-byte key.
The machine ID comes from the system volume serial, run through CRC32 five times. The malware also targets Chrome Local State keys.
Forescout recommends hunting for these signs:
long PowerShell scripts run from %TEMP% or using decimal IPs; silent MSI installs from %TEMP%; PowerShell launched with -NoProfile, -ep bypass or -w hidden alongside a URL; and POST requests whose body is a single Base64 blob.
The operator is unknown. ROMULUS could be a private panel, a commercial delivery service, an affiliate framework or copied software. Forescout found no link to the RomulusLoader that Proofpoint tied to Silver Fox.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
