ROMULUS: The ClickFix Platform Delivering Malware Across Six Servers

All technical details come from a single Infosecurity Magazine article reporting on Vedere Labs research; the vendor's original blog post was not accessible at the time of writing.

Researchers at Vedere Labs, Forescout's research team, discovered ROMULUS during an incident investigation. They identified a new malware delivery platform that transforms the ClickFix technique from isolated social engineering into reusable infrastructure. The platform operates across six distinct servers and distributes multiple payloads, including LegionLoader, leveraging executable files artificially inflated to approximately 842 MiB.

From Copy-Paste Command to Shared Backend

The ClickFix technique has spread as a social engineering scheme that tricks users into copying and pasting PowerShell commands or manual instructions provided by malicious web pages or compromised ads. Because the final execution occurs through the legitimate user, automated protections log the action as authorized, reducing the detection surface.

According to the researchers, threat actors have adapted this tactic into an entire ecosystem. ROMULUS represents the next step: a shared delivery backend that different operators can reuse to distribute distinct payloads. The platform is not tied to a single malware or a single campaign, but functions as generic infection infrastructure.

"Cybercriminals have started to adapt campaigns that deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims"
— Vedere Labs/Forescout Research, reported by Infosecurity Magazine

Six Servers and Distributed Architecture

Analysts identified six distinct servers running ROMULUS. This multiplicity is significant: a single hard-coded server would make discovery and takedown linear operations. The presence of multiple nodes indicates an architecture designed for resilience against disruption.

The researchers assess that the six servers could indicate management as a toolkit for a wide range of cybercriminals. It remains unquantified whether the servers are controlled by a single actor or by multiple customers of a common service. The term "at scale" used by the researchers is a qualitative assessment, not a verified numerical data point on infection volume or number of operators.

842 MiB as an Evasion Technique

A documented distribution route delivered LegionLoader — a second-stage downloader for installing additional payloads — packaged in encrypted archives. Inside the archive, the executable had been artificially inflated to approximately 842 MiB.

The evasion logic is mechanical. Many automated scanning systems impose size limits on files submitted for analysis: files exceeding predetermined thresholds are excluded from deep inspection. The researchers assess that an 842 MiB executable could pass through checks that would block standard-sized files. This assessment does not derive from empirical testing on specific tools.

The combination of encrypted archives — which prevent content inspection — and inflated files — which challenge processing limits — constitutes a dual strategy against automated defenses, while keeping the technical complexity required of the attacker low.

Why It Matters

The researchers did not document specific remedial measures or operational guidance. They did not specify the exact nature of any data potentially exposed by LegionLoader infections, nor the post-infection consequences beyond the download of additional payloads.

What emerges clearly is the direction of the threat landscape. ClickFix is particularly insidious because it externalizes the bypass of defenses onto the legitimate user: no vulnerability to patch, no exploit to sign, just social engineering that exploits trust in one's own behavior.

ROMULUS adds an industrial component to this model: a reusable backend that lowers the operational cost for attackers and increases the speed of pivoting between payloads. The separation between delivery infrastructure and final payload complicates attribution and response.

"ROMULUS is a reusable delivery backend rather than a single hard-coded malware server, suggesting it is being used at scale"
— Vedere Labs/Forescout Research, reported by Infosecurity Magazine

The identity of the operator behind the platform and the common ownership of the final malware families remain unknown. ROMULUS is separate from RomulusLoader, a form of malware identified by Proofpoint in early 2026: the name similarity is coincidental and the researchers explicitly drew the distinction to avoid confusion.

What Changes

The researchers did not provide operational guidance. The following section describes conceptual implications derived from the documented facts, without prescribing specific actions.

The reusable nature of ROMULUS raises questions about threat measurability. When a single infrastructure serves multiple payloads, infection statistics per malware family lose precision: the same server can host LegionLoader today and a different payload tomorrow, without the transition leaving obvious traces in public data.

The technique of the file inflated to 842 MiB further suggests that the resource constraints of security tools — size limits imposed for operational efficiency reasons — can be turned into evasion vectors. The researchers did not test which specific tools are vulnerable to this technique.

Finally, ClickFix's reliance on legitimate human action makes the threat inherently difficult to counter with automated technical controls. The line of defense shifts toward user awareness, but the researchers did not quantify the effectiveness of training interventions in this specific context.