New hacker service tricks people into installing malware themselves

Researchers have detailed a service called ROMULUS that criminals use to get people to infect their own computers. Fake web pages tell visitors to run a "fix," and that one action starts the malware. Forescout's Vedere Labs documented it, and it has been used to spread a malware program called Legion Loader.

What happened

Forescout describes ROMULUS as a malware delivery service. It uses ClickFix-style lures on bogus landing pages. ClickFix is a trick where a page claims something is broken and tells you to copy and run a command to repair it. The command is the attack. Forescout found six IP addresses (the internet addresses of servers) running ROMULUS.

Behind the page, ROMULUS offers two download points that fetch a PowerShell script. PowerShell is a built-in Windows tool for running commands. The script then decides what comes next: a tampered Windows installer file carrying a malware loader, or an encrypted archive holding Legion Loader. A loader is a small program that contacts a remote server to fetch and run more malware. The archive is padded to nearly 1 GB with repetitive filler, which helps it get past upload limits and some automated checks.

Why it matters

One address was also linked to a separate campaign that used malicious ChatGPT Custom GPTs to send victims to a fake web address serving the lure. Researchers say the findings show ClickFix is growing from a social trick into an effective way to get malware onto a machine. The person at the keyboard does the work, so the attack depends on persuasion, not on a software flaw.

Who is affected

The risk is highest for businesses whose staff browse the web on Windows computers. Small offices, clinics, home-care agencies and nonprofits without dedicated IT staff are the most exposed. The material does not say how many people have been infected.

What is not known

No one knows who is behind ROMULUS. Forescout says it could be a privately run panel, a commercial criminal service, an affiliate setup, or software copied between operators. It is not connected to RomulusLoader, a different malware family tied to a group called Silver Fox.

What to do

The steps in the alert box above cover what to do. The core idea is simple: a real error message never asks anyone to paste or run commands. Security teams are also advised to look for suspicious PowerShell activity.