ROMULUS ClickFix Platform Serves LegionLoader via Six IPs with ChatGPT Campaign Overlap

ROMULUS functions as a delivery panel exposing two endpoints that fetch a PowerShell stager. The stager selects either a trojanized MSI loader or an encrypted LegionLoader archive padded to nearly 1 GB with repetitive data to evade sandboxes and static thresholds. One IP, 86.109.75[.]7, directly hosted the ROMULUS panel while serving the same loader chain.

Technical evidence shows clear infrastructure reuse: 96.62.224[.]81 previously appeared in a campaign routing victims through fake ChatGPT Custom GPT pages into ClickFix execution. No code or domain overlap exists with RomulusLoader used by Silver Fox TA4922. The platform's design supports multiple downstream payloads, consistent with affiliate or commercial access models.

ClickFix has shifted from isolated social engineering to standardized entry-point infrastructure. Operators prioritize evasion through archive inflation and DLL sideloading rather than novel exploits. This pattern matches prior loader-as-a-service offerings where panels are shared or forked across criminal groups.

Defenders should prioritize PowerShell command-line telemetry and anomalous MSI execution over the next quarter. Continued monitoring of the listed IPs will reveal whether ROMULUS expands payload variety or migrates infrastructure following public disclosure.