ROMULUS ClickFix Platform Delivers LegionLoader: Detection and Defense Guide for SOC Teams

Forescout Research – Vedere Labs has disclosed a new malware delivery platform called ROMULUS that industrializes the ClickFix social-engineering technique to distribute LegionLoader and other malware families. For defenders, this matters because ClickFix inverts the traditional exploitation model: there is no vulnerability to patch, no exploit to signature, and no malicious attachment to sandbox. The victim is the exploit. Bogus landing pages — typically disguised as CAPTCHA verification, browser update prompts, or document-sharing portals — instruct users to press Win+R, paste a clipboard-pre-loaded command, and hit Enter. The user manually executes the initial stager, bypassing email gateways, attachment detonation, and most web-filtering controls in one keystroke.

LegionLoader is a well-known commodity loader that acts as a downstream delivery vehicle for infostealers and ransomware precursors (historically linked to payloads like LummaC2, Vidar, and stealers resold through MaaS channels). A ROMULUS infection in your environment is not the endgame — it is the opening move. SOC teams should treat any confirmed ClickFix-style execution as a full incident, not a malware cleanup ticket.

Technical Analysis

How the Attack Works

The ROMULUS kill chain, as described by Forescout, follows the now-standard ClickFix pattern with platform-grade polish:

Delivery / Lure: Victims land on attacker-controlled pages via malvertising, SEO poisoning, compromised sites, or phishing links. The page presents a fake CAPTCHA ("Verify you are human") or a simulated browser/document error.
Clipboard Injection: JavaScript on the page silently copies a malicious command to the victim's clipboard — no file download occurs.
User-Driven Execution: The page instructs the user to open the Run dialog (Win+R), paste (Ctrl+V), and execute. Because the command is launched interactively from explorer.exe via the Run dialog, it inherits a trusted parent process and user context.
Stager Execution: The pasted command is typically a one-liner invoking mshta.exe against a remote URL, or a PowerShell cradle (iwr/iex-style) that pulls a second-stage script. ConFuzzy/verification-style lures frequently abuse mshta.exe to execute remote HTA content because mshta is a signed Microsoft binary (LOLBin).
Loader Deployment: The stager downloads and executes LegionLoader, which then fingerprints the host, establishes C2, and retrieves follow-on payloads — infostealers, RATs, or additional loaders.

Why This Evades Traditional Controls

No attachment, no macro: Email security and Office macro policies are irrelevant.
User-initiated execution: The process tree starts at explorer.exe → mshta.exe / powershell.exe, which looks superficially like legitimate user activity.
Living-off-the-land binaries: mshta.exe, powershell.exe, rundll32.exe, and curl.exe are all signed, ubiquitous, and often whitelisted.
Clipboard-based payload staging: Nothing crosses the wire until the user acts, so network inspection sees only the final C2/stager fetch.

Exploitation Status

ROMULUS is confirmed active in the wild as a delivery-as-a-service platform per Forescout's disclosure. This is not a theoretical technique — ClickFix lures have been observed at scale throughout 2025 and into 2026 across multiple threat actor groups, and ROMULUS lowers the barrier to entry further by productizing it. No CVE is associated with this activity; it abuses intended OS functionality and human trust.

Detection & Response

The highest-fidelity detection surface is the process-execution chain: explorer.exe spawning mshta.exe or powershell.exe with remote-content command lines, followed by child processes and network connections from those LOLBins. The rules and queries below are tuned to that behavior to minimize noise.

YAML

---
title: ClickFix-Style mshta.exe Execution via Run Dialog
description: Detects mshta.exe launched by explorer.exe with a remote URL in the command line, consistent with ROMULUS/ClickFix paste-and-run lures that abuse mshta as a signed LOLBin stager.
id: 3f8c1a2e-7b94-4d51-9c63-2e7a5b8d9f01
status: experimental
references:
  - https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
  - https://attack.mitre.org/techniques/T1218/005/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1218.005
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  filter_legit:
    CommandLine|contains:
      - '\\sharepoint.com\\'
condition: selection and not filter_legit
falsepositives:
  - Rare legacy intranet HTA applications launched by users
level: high
---
title: Suspicious PowerShell Cradle Spawned from Explorer Run Dialog
description: Detects PowerShell launched interactively from explorer.exe with download-cradle patterns (iwr/iex/encoded commands) typical of ClickFix paste-and-execute stagers delivering loaders such as LegionLoader.
id: 91c4d7f2-3a68-4e1b-b5f9-8d2c6a4e7b35
status: experimental
references:
  - https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - 'iwr '
      - 'irm '
      - 'Invoke-WebRequest'
      - 'Invoke-Expression'
      - 'iex'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'curl.exe'
      - 'Start-BitsTransfer'
  condition: selection_parent and selection_flags
falsepositives:
  - Power users and admins running ad-hoc download commands from the Run dialog (rare in most environments)
level: high
---
title: LegionLoader Follow-On Execution - mshta or PowerShell Spawning Child Processes
description: Detects mshta.exe or PowerShell spawning command interpreters, script engines, or unsigned executables, consistent with post-stager loader deployment observed in ClickFix/LegionLoader infections.
id: 5b2e9d41-6f83-4c2a-a7d4-1f9e3c8b5a62
status: experimental
references:
  - https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\mshta.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
  condition: selection
falsepositives:
  - Legacy HTA-based administrative tooling (should be inventoried and excluded explicitly)
level: high

KQL — Microsoft Sentinel / Defender

// Hunt for ClickFix/ROMULUS-style execution: LOLBin stagers spawned interactively from explorer.exe
// with remote-content command lines, plus their downstream network connections.
let lookback = 7d;
let suspiciousProcs =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("http://", "https://", "iwr ", "irm ", "Invoke-Expression", "FromBase64String", "-enc", "Start-BitsTransfer")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessId, SHA256, InitiatingProcessFileName;
suspiciousProcs
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | project DeviceName, InitiatingProcessId=ProcessId, RemoteUrl, RemoteIP, RemotePort, NetworkTime=TimeGenerated
) on DeviceName, $left.ProcessId == $right.InitiatingProcessId
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, SHA256
| order by TimeGenerated desc

VQL — Velociraptor

-- Hunt for ClickFix/ROMULUS stager execution and payload staging artifacts
-- 1) Interactive LOLBin stagers spawned from explorer.exe with remote URLs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(https?://|iwr |irm |Invoke-Expression|FromBase64String|-enc)'
  AND Name =~ '(mshta|powershell|pwsh|rundll32)'

-- 2) Recently written executables/scripts in user-writable staging dirs (last 24h)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/*/AppData/Local/Temp/*.ps1',
                 'C:/Users/*/AppData/Roaming/**/*.exe',
                 'C:/Users/*/Downloads/*.hta'],
          accessor='ntfs')
WHERE Mtime > now() - 86400

-- 3) RunMRU keys: forensic evidence of what users pasted into the Run dialog
SELECT Name AS RunEntry, Data.value AS Command, ModTime
FROM foreach(row={
    SELECT FullPath FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU', accessor='registry')
}, query={
    SELECT Name, Data, ModTime FROM stat(filename=FullPath, accessor='registry')
})

PowerShell

# ROMULUS / ClickFix hardening and verification script — run elevated on Windows endpoints or via RMM

# 1) Block mshta.exe outbound network access (primary ClickFix stager LOLBin)
New-NetFirewallRule -DisplayName "Block mshta.exe Outbound (ClickFix Mitigation)" `
    -Direction Outbound -Program "$env:SystemRoot\System32\mshta.exe" `
    -Action Block -Profile Any -Enabled True
New-NetFirewallRule -DisplayName "Block mshta.exe Outbound x86 (ClickFix Mitigation)" `
    -Direction Outbound -Program "$env:SystemRoot\SysWOW64\mshta.exe" `
    -Action Block -Profile Any -Enabled True

# 2) Enable PowerShell Script Block and Module logging for cradle detection
$sbPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item -Path $sbPath -Force | Out-Null
Set-ItemProperty -Path $sbPath -Name "EnableScriptBlockLogging" -Value 1
Set-ItemProperty -Path $sbPath -Name "EnableScriptBlockInvocationLogging" -Value 1

# 3) Ensure process creation command-line auditing (Event 4688 cmdline capture)
$auditPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
New-Item -Path $auditPath -Force | Out-Null
Set-ItemProperty -Path $auditPath -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1

# 4) Verify: enumerate recent 4688 events matching ClickFix patterns for triage
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-2)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'mshta\.exe.*http|explorer\.exe.*(iwr|irm|Invoke-Expression|FromBase64String)' } |
  Select-Object TimeCreated, Message | Format-List

# 5) Report firewall rule status for validation
Get-NetFirewallRule -DisplayName "*ClickFix*" | Select-Object DisplayName, Enabled, Action

Remediation

There is no patch for ROMULUS — it exploits user behavior and legitimate OS binaries. Defense must be layered:

Block mshta outbound at the host firewall (script above). Legitimate enterprise use of mshta against remote URLs is vanishingly rare; this single control breaks the most common ClickFix stager. Validate against any legacy HTA apps first.
Application control: Deploy AppLocker or WDAC policies restricting mshta.exe, and constrain powershell.exe to Constrained Language Mode for standard users. Treat rundll32.exe and regsvr32.exe launched from user contexts with the same suspicion.
User awareness — specific, not generic: Train users on the exact ClickFix pretext: no legitimate CAPTCHA, browser update, or document portal will ever ask you to press Win+R and paste a command. This one sentence, drilled into users, defeats the entire technique class.
Web filtering and browser controls: Block newly registered and uncategorized domains at the proxy; ensure SmartScreen/ Safe Browsing is enforced and cannot be bypassed by users. Alert on clipboard-write events from browser pages if your EDR supports it.
Telemetry prerequisites: Confirm command-line capture for Event 4688, PowerShell Script Block Logging (4104), and that Sysmon or equivalent EDR process lineage is ingested into your SIEM. Without parent-child lineage, ClickFix detection is nearly impossible.
Incident response posture: If any rule above fires, treat it as a loader incident: isolate the host, assume infostealer deployment, rotate credentials reachable from that endpoint (browser-stored, session tokens, cached creds), and hunt laterally for LegionLoader C2 before reimaging. Do not close as "malware removed."
Threat intel tracking: Monitor Forescout Vedere Labs' published ROMULUS indicators (landing page domains, staging URLs, LegionLoader C2) and ingest them into your blocklists and SIEM watchlists as they are released.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub