Malware · 5h ago
Forescout said on October 14 that a ROMULUS server was acting as a shared ClickFix delivery platform, with six servers identified and the same backend tied to multiple malware routes. The finding shows ClickFix is being used as reusable infrastructure, not just a one-off lure.
ClickFix works by getting the victim to run attacker-supplied commands on their own machine, so the action looks like trusted user activity instead of an external exploit. ROMULUS takes that model further by swapping payloads behind the same delivery layer, and one route used oversized encrypted archives with an executable inflated to about 842 MiB to make scanning harder.
For defenders, the exposure sits in the delivery backend as much as in any single lure or payload. If that backend can be repurposed, taking down one campaign sample does not end the mechanism that can keep serving new malware families.
1 source covering this story
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Researchers at Forescout said the discovery shows how ClickFix is evolving from a delivery technique into full-blown cyber-criminal infrastructure
Part of the PlainSec briefing for 2026-10-14