# Hackers Deploy New ROMULUS ClickFix Platform to Spread LegionLoader Malware

Researchers report that threat actors are using a new ClickFix-based distribution service called ROMULUS to deliver LegionLoader and other malware families. ClickFix attacks trick victims into pasting and executing malicious commands copied from fake browser verification prompts. The platform matters because packaged tooling like this lowers the effort needed to run widespread malware delivery campaigns.

**Importance:** 3/5

## Sources

### Security
- [The Hacker News](https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html) — Tue, 20 Oct 2026 09:35:58 +0530