Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. The work was published by Forescout Research - Vedere Labs, which identified six IP addresses running ROMULUS. The researchers also described another campaign that has been found to leverage malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving the ClickFix lure.
What happened
Forescout Research - Vedere Labs described ROMULUS as something close to a malware delivery service. The description points at shared infrastructure rather than a single campaign.
ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines.
Legion Loader was named among the malware distributed through it.
How it was done
The method relies on the user, not on an exploit. A bogus landing page presents a ClickFix-style lure, and the person is tricked into running a malicious command on their own machine. That turns the final execution step into something that looks like ordinary user activity.
The researchers identified six IP addresses running ROMULUS. The IP address "96.62.224[.]81" was identified as hosting a ClickFix script and an MSI installer file. Separately, the researchers described a campaign that has been found to leverage malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving the ClickFix lure.
What to check
The useful checks here are about user-initiated execution and about where staff follow links from.
Hunt for commands launched from the Run dialog
Query endpoint telemetry for process creation where the parent is explorer.exe and the child is powershell.exe, cmd.exe or mshta.exe. On Windows, also check the RunMRU registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Encoded strings or remote download commands in that history are a bad result.
Review MSI installs on user endpoints
Pull msiexec.exe executions from the last 90 days and check the package source path. Installs that run from a browser download folder or a temporary directory, rather than from your software distribution system, deserve a direct look at the host.
Search proxy and DNS logs for the named address
Search egress logs for connections to 96.62.224[.]81 and for raw IP destinations without a matching DNS lookup. Export the matching source hosts and treat any browser process making those connections as the starting point for triage.
Restrict scripting hosts for standard users
Check whether mshta.exe, wscript.exe and cscript.exe can run from user-writable paths. Use application control policies to block them, then test that your own admin tooling still works before enforcing broadly.
Look at how AI assistants are used at work
Inventory the AI tools staff use in the browser and whether links returned by them pass through your web filtering. Treat assistant output as untrusted content for link handling, the same way you treat email.
Give people a fast way to report a paste prompt
Confirm the report button or help desk path is visible in the browser and on the desktop. A page asking someone to copy a command and paste it into a terminal should be reportable in one click, with no judgement call about whether it is worth reporting.