New ROMULUS Platform Delivers LegionLoader and Other Malware

Cybersecurity researchers have disclosed a new ClickFix delivery platform called ROMULUS, which is being used to distribute malware like Legion Loader.

The vulnerability or weakness

Not stated in the sources.

Earlier attacks and coverage

• Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks (2026-10-19)

Business impact

Organizations are at risk of malware infections that could disrupt operations, compromise sensitive data, and lead to financial losses.

Industries affected

All sectors are potentially affected, as the platform is not industry-specific.

Users affected

End users are vulnerable to infection if they visit malicious landing pages or execute malicious commands.

Sources

• Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (The Hacker News)