ROMULUS ClickFix Platform: How Attackers Are Tricking Users Into Infecting Themselves

Cybersecurity researchers at Forescout Research — Vedere Labs have published details of a malware delivery platform called ROMULUS, as reported by The Hacker News. ROMULUS uses ClickFix-style lures — convincing fake web pages that instruct users to open a command prompt and paste in a command to resolve a supposed technical problem. When users follow these instructions, they inadvertently execute malicious code that installs LegionLoader, a malware loader capable of deploying information stealers, browser credential harvesters and additional payloads. The platform operates as a service, suggesting it is being made available to multiple threat actors rather than being used exclusively by a single group.

Why this matters for UK organisations

ClickFix attacks are effective precisely because they bypass many traditional security controls. Rather than delivering a malicious file that endpoint detection tools might flag, the technique relies on the user to execute the payload themselves — often under the impression that they are completing a legitimate verification step or resolving a browser error. The fake pages are frequently well-designed and impersonate familiar scenarios such as CAPTCHA checks, software update prompts or Microsoft verification pages. For organisations where users have local administrator rights, the impact of a successful ClickFix lure can be significant, as the malicious command runs with the user's full privileges.

The deployment of LegionLoader as the primary payload is also notable. As a loader, it is designed to establish a foothold and then retrieve further malware — meaning the initial infection is often just the beginning of a more extensive compromise that may include credential theft, lateral movement or ransomware deployment.

What to review

UK organisations should confirm whether security awareness training specifically covers ClickFix-style lures and the principle that no legitimate website or service will ever ask a user to open a command prompt and run pasted instructions. Reviewing and restricting local administrator rights — particularly for users who do not require them for their day-to-day role — is one of the most effective technical controls against this class of attack. Web filtering and DNS security controls that block access to known malicious domains used in ClickFix campaigns can also provide a useful additional layer of defence.

Source: The Hacker News