Security researchers at Forescout's Vedere Labs have identified a malware delivery platform called ROMULUS that abuses ClickFix-style fake CAPTCHA pages. The platform tricks visitors into copying and running malicious commands, ultimately installing loaders such as LegionLoader on their own machines.
ROMULUS runs on at least six IP addresses, according to the researchers. One of those addresses was tied to a campaign that used malicious ChatGPT Custom GPTs to steer victims to a fake URL serving the ClickFix lure. The platform exposes two endpoints that fetch a PowerShell staging script, which then chooses between a trojanized MSI installer or an encrypted archive containing LegionLoader. The archive is padded to nearly 1 GB to evade upload limits and sandbox analysis.
The identity of ROMULUS's operators remains unknown. Forescout found no overlap with RomulusLoader, a separate malware family linked to the China-aligned threat actor Silver Fox. The researchers recommend hunting for suspicious PowerShell commands and DLL sideloading events to reduce the risk from this evolving ClickFix technique.