New ROMULUS ‘ClickFix’ Platform Enables Rapid Distribution of LegionLoader and Other Malware

Cybersecurity analysts have identified a novel malicious delivery system, dubbed ROMULU S, that leverages a ClickFix‑style infrastructure to push payloads such as the LegionLoader trojan onto compromised devices. The findings were released by Forescout Research’s Vedere Labs, which described the platform as a turnkey service that automates the upload, hosting, and dissemination of malicious code.

According to the researchers, ROMULUS operates by masquerading as a legitimate software‑update or fix utility—commonly referred to as a "ClickFix"—to entice users into initiating a download. Once the user clicks the deceptive prompt, the platform streams the payload, which can include a range of malware families, with LegionLoader being the most frequently observed. LegionLoader is known for its ability to load additional malicious modules and establish persistent footholds within victim networks.

The service appears to be designed for low‑cost, high‑volume distribution, offering threat actors a ready‑made pipeline that sidesteps many traditional defenses. By embedding the delivery mechanism within what looks like a routine system patch, attackers exploit the trust users place in software updates, a tactic that has grown increasingly popular among ransomware and espionage groups.

Vedere Labs highlighted that ROMULUS’s architecture resembles a “malware‑as‑a‑service” model, where operators can select from a catalog of payloads and configure delivery parameters without deep technical expertise. This modular approach lowers the barrier to entry for less sophisticated actors, potentially expanding the pool of threat actors capable of deploying sophisticated tools like LegionLoader.

Security experts warn that the rise of such platforms complicates detection efforts. Traditional signature‑based solutions may miss the initial ClickFix vector, while behavioral analytics must now account for a broader spectrum of benign‑looking update traffic. Organizations are urged to tighten verification of software updates, enforce application whitelisting, and monitor network traffic for anomalous download patterns.

While the exact origins of ROMULUS remain unclear, its emergence underscores a broader trend toward service‑oriented cybercrime, where the infrastructure for malware distribution is abstracted and commercialized. Researchers anticipate that similar platforms could appear in the near future, offering a menu of payloads that can be swapped out as defenses evolve.

Forescout’s disclosure follows earlier reports from The Hacker News, which first flagged the platform’s activity. As investigators continue to dissect ROMULUS, they recommend that enterprises adopt multi‑layered security strategies, including endpoint detection and response (EDR) tools, regular patch management, and user education campaigns focused on the risks of unsolicited software fixes.