ROMULUSROMULUS

Multi-payload ClickFix delivery platform reported by Forescout Research - Vedere Labs, running on at least six servers. A shared backend with a login panel and install statistics serves PowerShell staging scripts that pick the next payload: trojanized MSI installers abusing DLL sideloading (including a Stardock DeElevation chain and, per Siemens and Huntress, a signed Siemens Software Center abused through CVE-2026-110936) or an encrypted archive delivering LegionLoader (Satacom). Some lures were reached through malicious ChatGPT custom GPTs. Forescout does not know whether it is a private panel, a commercial delivery service, an affiliate framework or copied software, and states it has no evidence linking it to RomulusLoader, the unrelated loader associated with Silver Fox.