Security1 hOctober 14, 2026, 21:00

Forescout finds ROMULUS server delivering malware via ClickFix

Researchers at Vedere Labs, part of Forescout Research, uncovered the ROMULUS panel, a reusable backend for delivering multiple malware payloads via ClickFix tactics. Six servers running ROMULUS were identified; one delivery route pushed LegionLoader through an encrypted archive with a file inflated to about 842 MiB.

Infosecurity Magazine

Open source

Forescout finds ROMULUS server delivering malware via ClickFix

ROMULUS is a reusable multi-payload delivery platform, not a single server
Six servers running the ROMULUS panel were identified
LegionLoader was delivered via an archive with a ~842 MiB file
ClickFix bypasses defenses because the user runs the commands

#Forescout#ClickFix#LegionLoader

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Security

Hacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack

Security

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Security

Forescout finds ROMULUS server delivering malware via ClickFix

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Hacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

PoeLLM cryptomining malware hits over 3,400 servers via exposed AI services