Forescout details ROMULUS ClickFix platform delivering LegionLoader

Forescout Research — Vedere Labs disclosed a ClickFix delivery platform called ROMULUS that operates as a malware delivery service. It uses bogus landing pages to trick users into running malicious commands themselves, distributing LegionLoader and other malware.

• ROMULUS operates as a malware delivery service
• Attacks rely on ClickFix lures and fake landing pages
• Victims are tricked into running malicious commands manually
• The platform distributes LegionLoader and other malware