RomulusLoader: ClickFix campaign via malicious ads and fake custom GPT pages tricks Windows users into pasting a PowerShell command that installs Romulus Loader (Unit 42)

Unit 42 reports (31 Oct 2026) a live ClickFix campaign that delivers Romulus Loader on Windows. Victims reach the lure through malicious ads on compromised websites or through malicious custom GPT pages on chatgpt.com, and are told to paste a PowerShell command into the Run dialog (Win+R). The command writes the server IP as a plain integer to evade detection, then fetches an MSI (sometimes posing as legitimate software, e.g. ExpertCopyFilesIntoMultipleFoldersLite.msi). Payloads are hidden in the MSI's Binary table and run through VBScript custom actions and PowerShell. The loader patches AMSI in a suspended RuntimeBroker.exe, injects into explorer.exe with one of 10 techniques, persists through the RunOnce key, fingerprints the host and sends the data to scridea[.]com/nfront.php. Its strings reference DPAPI, app-bound encryption and browser data paths, so credential theft is likely. Victim count and sectors: unknown.