Security researchers have disclosed a malware delivery platform called ROMULUS that is reportedly being used to distribute threats including Legion Loader. According to Forescout Research - Vedere Labs, the activity relies on ClickFix-style social engineering, where users are shown fake landing pages and persuaded to run malicious commands themselves.

For European businesses, the case is a reminder that many cyberattacks no longer depend only on software vulnerabilities. Instead, attackers increasingly use convincing web pages, fake error messages and step-by-step prompts to get employees to bypass normal security caution and trigger the infection manually.

What happened

Based on the researchers' findings, ROMULUS appears to operate as a malware delivery platform. Its method uses bogus landing pages designed to mislead users into executing commands on their own machines. Researchers said the platform has been used to deliver malware such as Legion Loader.

The source information does not indicate that this is a newly mandated compliance issue or a change in law. It is a threat-intelligence development: a reported attack technique and delivery model that businesses should factor into security awareness, endpoint protection and web filtering practices.

Why it matters for European businesses

The practical risk is significant because ClickFix-style attacks can be effective even in organisations with modern security tools. If an employee is convinced to copy, paste or run a command, the attacker may bypass some traditional protections that are more focused on blocking malicious attachments or known exploit patterns.

This matters in several common business scenarios:

• Office users may encounter fake browser alerts, software update prompts or support-style pages while researching suppliers, downloading tools or accessing cloud services.
• Remote and hybrid teams may be more exposed if personal judgment becomes the main barrier between a deceptive webpage and command execution.
• SMEs often have limited in-house security capacity, which can make social-engineering-led malware delivery harder to detect quickly.
• Digital businesses that depend on SaaS, browsers and online admin tools face elevated operational risk if a compromised endpoint is later used to access customer data, marketing accounts or internal systems.

If a loader malware strain reaches a device, it may act as a foothold for additional payloads, credential theft or broader compromise. Even when the initial infection looks minor, the downstream business impact can include account takeover, service disruption, data exposure or incident response costs.

Who may be affected

The threat is relevant across sectors, but several groups should pay particular attention:

• SMEs and founders that rely on small IT teams or outsourced support.
• Marketing and e-commerce teams with access to ad platforms, CMS environments, analytics tools and customer databases.
• IT administrators and helpdesk teams whose users may encounter fake technical instructions presented as troubleshooting steps.
• Regulated businesses where a compromised workstation could create wider compliance, operational or reporting consequences.

Any organisation whose employees regularly interact with web content, browser prompts, downloads or cloud logins should assume this attack pattern could target them.

What companies should consider

While the source report focuses on the threat itself, there are several practical steps businesses can review now:

• Update security awareness training to cover ClickFix tactics specifically, including fake error pages, fake verification steps and requests to run commands locally.
• Restrict unnecessary command execution on user endpoints where operationally possible, especially for non-technical staff.
• Review endpoint detection and response coverage to ensure suspicious script or command activity can be logged and investigated.
• Use least-privilege access so that a compromised user account or device has limited reach into business-critical systems.
• Harden browser and web filtering controls to reduce exposure to known malicious or newly registered domains.
• Protect high-value business accounts such as email, e-commerce admin, CRM and advertising platforms with strong authentication and access monitoring.
• Prepare an incident response path for cases where a user has already run a suspicious command, including device isolation and credential resets.

For European organisations, the broader lesson is clear: cybersecurity defences need to account not only for malicious files and exploits, but also for web-based persuasion techniques that turn routine user actions into the entry point for malware.