Researchers from Forescout - Vedere Labs have identified ROMULUS, a ClickFix-style malware delivery platform used by threat actors to distribute LegionLoader and other malware. The campaign employs bogus landing pages with deceptive lures that trick users into executing malicious commands, resulting in infection.

Which products are affected?

ROMULUS platform (malware delivery service)

What should defenders do?

Users and organizations should avoid interacting with suspicious ClickFix-style prompts or commands prompted by unfamiliar web pages. Security awareness training should focus on recognizing social engineering lures. Endpoint security solutions should be kept updated to detect and block LegionLoader and associated malware. Avoid visiting untrusted websites and heed browser warnings for potentially harmful content.

highMalware

ROMULUS ClickFix Platform Exploited to Deliver LegionLoader and Secondary Malware

Forescout Research reveals new malware delivery service leveraging social engineering lures

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

ROMULUS ClickFix Platform Exploited to Deliver LegionLoader and Secondary Malware

Key Takeaways

ROMULUS is a ClickFix-style malware delivery platform identified by Forescout - Vedere Labs.
The platform distributes LegionLoader and other malware via bogus landing pages.
Infection relies on social engineering lures that trick users into running malicious commands.
No zero-day vulnerabilities are exploited; the attack vector is user-interaction-based.

Related Security News

highCyber Attacks

Hackers Exploit Plex2Shell Chain to Deploy Crypto Miners and Linux Backdoor

Threat actors have begun exploiting a chain of four vulnerabilities in Plex Media Server, tracked collectively as Plex2Shell, to deploy cryptocurrency miners and a Linux reverse proxy backdoor. The exploitation activity emerged shortly after a proof-of-concept was published publicly. The researcher boredhackerblog reported the chaining technique, though full technical details and CVE identifiers remain pending disclosure.

The Hacker Newsabout 6 hours ago1 min read