[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGpUpJ6-xj0dynGvGz0qo45JIVzmP9pVVJY8pgvUXI4w":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"c360dbfa-535c-4559-9a0d-050760032c1c","Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks","forescout-uncovers-romulus-malware-delivery-platform-behind-clickfix-attacks-b1e848","Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity. The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious […] The post Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks appeared first on IT Security Guru.","Forescout's Vedere Labs has identified a new malware delivery platform named ROMULUS, which is being used in ClickFix campaigns. These attacks employ novel delivery techniques and are associated with malware loaders linked to Vice Society ransomware activity. The research details the post-infection stages after victims are tricked by ClickFix lures.","Forescout discovers new ROMULUS malware platform used in ClickFix attacks, linked to Vice Society.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F10\u002F16\u002Fforescout-uncovers-romulus-malware-delivery-platform-behind-clickfix-attacks\u002F?utm_source=rss&utm_medium=rss&utm_campaign=forescout-uncovers-romulus-malware-delivery-platform-behind-clickfix-attacks",null,"2026-10-16T13:50:21+00:00","2026-10-16T14:00:10.659198+00:00",8,[17,20,23],{"name":18,"type":19},"ROMULUS","product",{"name":21,"type":22},"ClickFix","campaign",{"name":24,"type":25},"Forescout","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":37},{"id":26,"icon":12,"name":28,"slug":29},{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,18],{"controls":46,"vendors":130},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":77,"name":78,"problem":79,"products":80},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":106,"product_name":127,"url":128,"description":129},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":147},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","The ROMULUS malware delivery platform succeeds primarily because it exploits human behavior — tricking victims into executing malicious code themselves through ClickFix social engineering lures, bypassing many technical controls. Once a user is deceived, the platform deploys loaders linked to Vice Society ransomware activity, significantly escalating the potential damage. This highlights that even well-patched environments can be compromised when end users are not trained to recognize novel delivery techniques. The multi-stage post-infection chain also indicates that early detection gaps allow attackers to establish deep footholds before defenders respond. Organizations without robust behavioral monitoring and tested incident response plans face the greatest exposure.",[136,137,138,139,140,141,142,143,144,145,146],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 AU-6: Audit Record Review and Reporting","MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1059: Command and Scripting Interpreter","ITIL Service Operation: Event Management",{}]