Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix prompt can become an entry point for infection.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A website says, ‘Run this command to verify.’ That’s the trap. ROMULUS uses this ClickFix trick. A fake page gets you to paste a command; PowerShell runs, and Legion Loader can land on your computer. One route starts with a malicious ChatGPT Custom GPT linking to a fake site. The giveaway: instead of your AI result, it wants a command, or an MSI installer. A real verification doesn’t need PowerShell. If a page asks you to run a command, report the page to security.
Attackers abused a trusted, signed Siemens Software Center program to run malicious code and install a remote access trojan. Victims were directed to a fake web address containing a ClickFix lure, where copying and running the displayed content launched PowerShell and an installer that exploited…
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Attackers registered a long-used “placeholder” domain (third-party[.]com) that appears in developer documentation and code examples, then used it to trick Windows visitors with a fake Cloudflare-style verification page. The site tries to convince people to open the Windows Run box and paste a…
Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied…
