Titre original (traduit automatiquement) : Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
ROMULUS, a ClickFix delivery platform, was discovered using fake landing pages to make users run malicious commands. It was found to serve PowerShell staging scripts that deploy trojanized MSI installers or padded encrypted archives containing Legion Loader. Researchers found six IP addresses running the platform. One also hosted a ClickFix script linked to malicious ChatGPT Custom GPTs and Legion Loader, then retrieved further payloads.
Source originale
thehackernews.com