Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives. The platform supports separate infection paths, including one that installs LegionLoader and another that abuses a legitimate Stardock program to load malicious code. The findings show how a single delivery system can serve different malware packages while hiding activity behind trusted tools. ClickFix tricks people into running commands themselves, often through fake verification prompts or repair instructions, turning an ordinary browser visit into the start…