Skip to content
Hacker Posts

ROMULUS: a ClickFix delivery platform pushing LegionLoader

Forescout details ROMULUS, a ClickFix delivery platform that drops LegionLoader and a trojanized MSI, padding payloads to ~1GB to evade sandboxes. IOCs below.

Published 3 min read
threat-intelclickfixlegionloaderforescout

Forescout Research (Vedere Labs) has published an analysis of ROMULUS, a ClickFix-style delivery platform that tricks users into running malicious commands on their own machines and then stages one of two payload chains. The write-up, by researcher Sai Molige and dated October 15, is the primary source: ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform. The Hacker News corroborated the findings.

What ROMULUS is

ClickFix lures victims to fake pages and talk them into pasting a command — typically a PowerShell one-liner that fetches the next stage. ROMULUS is the back end behind such lures. Forescout is careful not to over-claim what it is: Molige says it "may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators." It is not the same thing as RomulusLoader, which has been linked to Silver Fox (TA4922); Forescout found no overlap.

What it delivers

The staging script picks one of two routes:

  • Route A — a trojanized Stardock "Smart DeElevation Tool" MSI that sideloads a malicious loader (I++u.dll).
  • Route B — an encrypted 7-Zip archive carrying LegionLoader (also tracked as Satacom, CurlyGate, and RobotDropper). The carrier is inflated to roughly 1 GB (an 842 MiB file in the sample) to slip past upload-size limits, sandbox file-size budgets, and static analysis.

One related campaign routed victims through malicious ChatGPT Custom GPTs to the ClickFix lure — the same social-engineering-via-AI vector we covered in Huntress's Custom GPT ClickFix report.

Detection

Forescout points defenders at suspicious PowerShell execution and DLL sideloading events rather than a single static signature. Indicators published by Forescout Research (Vedere Labs):

IPs / domains
  96.62.224[.]81
  86.109.75[.]7
  151.240.151[.]223
  23.94.145[.]224
  93.152.224[.]118
  2.27.248[.]127
  orbitflownetwork[.]lol
  smashshape[.]com
  novatrafficcore[.]lol/AsFJfTQYDTkpOg6K

SHA256
  91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2  IconEdit2Turb.msi
  6147d56b5e35d6435d83adb49908c40a97520a0c3379121104816e37cbd1df28  Route A staging script
  62ca523863337ac5d6b1c4d9ae262d1b2eb7dd9ca764b702ef719c84b2437a39  Route B staging script
  3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621  I++u.dll
  2e3d378d6a842af2404dfcd1dcbfc0df84b01b799b2c8270ddbfe5eb18837762  Stage 3 LegionLoader PE

Forescout did not publish YARA or Sigma rules; the blog gives hunting guidance in prose.

What to do

  1. Block the IPs and domains above and hunt historical DNS and proxy logs for them.
  2. Alert on clipboard → Run dialog → PowerShell sequences and on PowerShell spawned by a browser or Explorer — the ClickFix signature.
  3. Treat an inbound archive approaching 1 GB that unpacks to a small executable as suspicious, not benign-because-big.
  4. Reinforce that no legitimate site asks a user to paste a command to "verify" they are human.

Context

ClickFix has become the dominant initial-access social-engineering technique of 2026, and we have tracked its spread across lures — Ghost CMS, malvertising, a fake Siemens portal, and Lunex stealer against Ukraine. ROMULUS is the logical next step: not another lure, but the shared machinery behind many of them. If one panel services multiple operators, a single takedown or detection reaches further than any one campaign.

Related stories