Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

ROMULUS, a ClickFix delivery platform, was discovered using fake landing pages to make users run malicious commands. It was found to serve PowerShell staging scripts that deploy trojanized MSI installers or padded encrypted archives containing Legion Loader. Researchers found six IP addresses running the platform. One also hosted a ClickFix script linked to malicious ChatGPT Custom GPTs and Legion Loader, then retrieved further payloads.