ROMULUS: a ClickFix delivery platform pushing LegionLoader
Forescout details ROMULUS, a ClickFix delivery platform that drops LegionLoader and a trojanized MSI, padding payloads to ~1GB to evade sandboxes. IOCs below.
Stories tagged: #clickfix
Siemens Software Center flaw abused in ClickFix attacks
Siemens says CVE-2026-110936, a DLL search-order flaw in Software Center, is being abused in the Romulus ClickFix campaign. The fix is in 4.0.9.8; hunt behaviorally.
Fake Claude installers ride Google ads through Bing redirects
Push Security details 'Adception,' a malvertising chain abusing Google ad clicks and Bing click-tracking redirects to send macOS users to fake Claude installers running a ClickFix command.
ClickFix campaign hits 100+ Ukrainian sites with Lunex stealer
CERT-UA, tracking the activity as UAC-0277, says more than 100 compromised websites push fake Cloudflare checks that trick users into running PowerShell and installing Lunex Stealer.
Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
Huntress found a weaponized ChatGPT Custom GPT that pushes victims through a Google Sites ClickFix page to a PowerShell-delivered RAT. At least 40 incidents investigated.
Ghost CMS SQLi (CVE-2026-26980) hijacks 700+ sites — Harvard, Oxford, DuckDuckGo serve ClickFix
An unauthenticated SQL injection in Ghost's Content API leaks admin API keys. Attackers chain it into stored XSS and a fake Cloudflare ClickFix lure. Upgrade to 6.19.1.