.jpg)
Cybercriminals have started to adapt campaigns that deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims, cybersecurity researchers have warned.
As detailed in a blog post published on October 14, security analysts at Vedere Labs, a part of Forescout Research, discovered the server hosting panel ROMULUS while investigating an incident.
They found that the exact same malware delivered by a separate ClickFix campaign was also connected to another server linked to the incident being investigated.
The new server was discovered to be hosting a panel called ROMULUS. Further analysis revealed this to be a new multi-payload shared ClickFix delivery platform.
ClickFix is a popular attack technique among cybercriminals. It relies on social engineering to trick the victim into running attacker-supplied commands on their own machine.
And because ClickFix relies on the real, trusted user of the machine to run the commands, action often bypasses any security protections that may be in place to stop unauthorized action.
ClickFix Able to be Deployed at Scale
The newly uncovered ROMULUS platform appears to be capable of deploying a range of attack routes to deliver different forms of malware. Researchers also note that ROMULUS is a reusable delivery backend rather than a single hard-coded malware server, suggesting it is being used at scale.
In total, Forescout analysts identified a total of six different servers running ROMULUS, something they said could indicate that this infrastructure is being run as a toolkit for a wide-range of cybercriminals to use to distribute their attacks.
ROMULUS is also notable for using an unusual method to help disguise its operations. One delivery route was observed to distribute LegionLoader, a multi-pronged malware delivery platform, through encrypted archives containing an executable artificially inflated to approximately 842 MiB, potentially exceeding file-size limits imposed by security scanning and analysis tools.
Researchers believe that this operation shows how ClickFix is evolving beyond a simple social engineering technique into an entry point for malware operations, while attackers are also diversifying their delivery infrastructure, disguising malicious activity and making threats harder to detect.
The identity of the operator behind the platform and common ownership of the final malware families are unknown. But it is noted that this ROMULUS platform is separate to RomulusLoader, a form of malware identified by researchers at Proofpoint earlier in 2026.
.jpeg)
