Researchers Identified New ROMULUS Malware Platform
The platform automates multi-payload malware delivery using social engineering, marking a shift in how threats are distributed.
Updated on Oct. 14, 2026 in Cybersecurity
Live Poll
Do you trust that current security software can adequately protect your personal data from new threats?
Security analysts have identified six servers hosting ROMULUS, a multi-payload malware delivery platform. The system uses social engineering techniques to compromise user machines.
Why it matters
The platform simplifies the deployment of varied malware types, creating a scalable infrastructure for diverse cyberattacks. Its emergence highlights an increasing reliance on social engineering to bypass automated security measures.
ROMULUS utilizes ClickFix, a social engineering method that prompts users to execute malicious commands. Malware archives are artificially inflated to 842 MiB to evade signature-based security scanning.
The players
Vedere Labs
A cybersecurity research group focused on identifying infrastructure and threat actors behind malware campaigns.
Proofpoint
A security firm specializing in email protection and threat intelligence that identified the related RomulusLoader.
The details
ROMULUS functions as a centralized delivery hub for multiple malware strains, including LegionLoader. The delivery process forces users to execute attacker-supplied commands through deceptive prompts. By inflating files to approximately 842 MiB, the platform attempts to exceed the processing limits of standard security scanners that often skip or truncate large archives.
Timeline
October 14, 2026: Vedere Labs published its findings regarding the ROMULUS server infrastructure.
2026: Proofpoint researchers previously identified the separate RomulusLoader entity.
The Tech Race
The development follows the established trend of ClickFix-based social engineering campaigns that bypass traditional technical controls. ROMULUS scales this approach by offering a shared delivery infrastructure, departing from bespoke distribution methods used in earlier campaigns.
Users should be wary of prompts requesting manual command execution, as this is the primary vector for ROMULUS infections. Organizations should verify that their security scanning tools are configured to inspect files larger than 842 MiB to mitigate evasion techniques.
The takeaway
ROMULUS demonstrates how attackers use file bloating to hide malicious payloads from standard defense tools. Security teams should monitor for large, encrypted archives that appear in suspicious, user-prompted workflows.
Further reading
For more on evolving threat infrastructure and detection methods, explore our Cybersecurity section.
Live Poll
Do you trust that current security software can adequately protect your personal data from new threats?
