Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
Forescout discovers new ROMULUS malware platform used in ClickFix attacks, linked to Vice Society.
Run Forescout?
Get an email when a reviewed story names Forescout, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Forescout's Vedere Labs has identified a new malware delivery platform named ROMULUS, which is being used in ClickFix campaigns. These attacks employ novel delivery techniques and are associated with malware loaders linked to Vice Society ransomware activity. The research details the post-infection stages after victims are tricked by ClickFix lures.
The lesson from this incident
Full lessonThe ROMULUS malware delivery platform succeeds primarily because it exploits human behavior — tricking victims into executing malicious code themselves through ClickFix social engineering lures, bypassing many technical controls. Once a user is deceived, the platform deploys loaders linked to Vice Society ransomware activity, significantly escalating the potential damage. This highlights that even well-patched environments can be compromised when end users are not trained to recognize novel delivery techniques. The multi-stage post-infection chain also indicates that early detection gaps allow attackers to establish deep footholds before defenders respond. Organizations without robust behavioral monitoring and tested incident response plans face the greatest exposure.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.