{"id":"CMP-202611-77axcf","kind":"campaign","aliases":[],"related":[],"title":"ClickFix campaign via malicious ads and fake custom GPT pages tricks Windows users into pasting a PowerShell command that installs Romulus Loader (Unit 42)","description":null,"summary":"Unit 42 reports (31 Oct 2026) a live ClickFix campaign that delivers Romulus Loader on Windows. Victims reach the lure through malicious ads on compromised websites or through malicious custom GPT pages on chatgpt.com, and are told to paste a PowerShell command into the Run dialog (Win+R). The command writes the server IP as a plain integer to evade detection, then fetches an MSI (sometimes posing as legitimate software, e.g. ExpertCopyFilesIntoMultipleFoldersLite.msi). Payloads are hidden in the MSI's Binary table and run through VBScript custom actions and PowerShell. The loader patches AMSI in a suspended RuntimeBroker.exe, injects into explorer.exe with one of 10 techniques, persists through the RunOnce key, fingerprints the host and sends the data to scridea[.]com/nfront.php. Its strings reference DPAPI, app-bound encryption and browser data paths, so credential theft is likely. Victim count and sectors: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-05T01:49:21+00:00","products":[{"name":"Windows","fixed":[],"vendor":"Microsoft"},{"name":"PowerShell","fixed":[],"vendor":"Microsoft"},{"name":"ChatGPT custom GPTs","fixed":[],"vendor":"OpenAI"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for Run-dialog (RunMRU) or PowerShell command lines containing an http URL whose host is a bare decimal number (e.g. hxxp://2549127012/app/...), or msiexec fetching an MSI from an IP. Look for a.ps1 in %TEMP% run with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden, new RunOnce entries, and HTTPS POSTs to scridea[.]com/nfront.php with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68'. Domains: 26-1167[.]com, cloubflare[.]net, coloperia[.]ru, de.lkjasdhf[.]sbs, havelbeenpwned[.]net, jasminebeltran[.]design, towerrush[.]cam, www.ifyvhody[.]top. IPs: 2.27.248[.]127, 23.94.145[.]88, 23.94.145[.]115, 23.94.145[.]201, 23.94.145[.]224, 23.94.145[.]229, 86.109.75[.]7, 86.109.75[.]12, 91.92.43[.]242, 93.152.224[.]118, 96.62.224[.]81, 151.240.151[.]100, 151.240.151[.]223, 167.148.201[.]191, 167.148.201[.]224. Lure pages: chatgpt[.]com/g/g-6abc09fdfb9081918c1ad488786899ef-plus-5-6, sites.google[.]com/view/antibot172881. SHA-256 (the MSI hash changes on every download): 253d24c32887aa47244e2a14573dd54a2e458d9d5746a0e9eac4acbd216618d7, 4455bd9fe82371d5f462c724df2005ea75083adbc7025014276acc0c21aa761b, ee044381cf31255c115e8407a1fdf6168faf8df60cb4c6c71995979844a8b0ed, 1fa8d8fe397706f55fe93ace8a4e19ae06d52d5affa078e7d9d9b56ac205a38a.","fix":"Block the listed domains and IPs. Tell users that no real website, CAPTCHA or GPT ever asks them to paste a command into Win+R or PowerShell. Where possible, turn off the Run dialog or restrict PowerShell for normal users and alert on PowerShell URLs that use a decimal-integer host. If a machine is hit, isolate it, remove the RunOnce persistence, and reset browser-saved passwords and sessions from a clean device.","status":"open","published_at":"2026-10-31T00:00:00+00:00","first_seen_at":"2026-11-05T01:49:21+00:00","triaged_at":"2026-11-05T01:49:21+00:00","updated_at":"2026-11-05T01:49:40+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':26A '-77':27A '10':144B '2026':46B '31':44B '42':24A,42B 'action':127B 'ad':5A,63B 'amsi':133B 'app':166B 'app-bound':165B 'axcf':28A 'binari':120B 'bound':167B 'browser':170B 'campaign':2A,37B,50B 'chatgpt':34A 'chatgpt.com':74B 'clickfix':1A,49B 'cmp':25A 'com/nfront.php':160B 'command':18A,82B,90B 'compromis':65B 'count':179B 'credenti':174B 'custom':8A,35A,70B,126B 'data':157B,171B 'deliv':52B 'detect':101B 'dialog':86B 'dpapi':164B 'e.g':111B 'earli':39B 'early-warn':38B 'encrypt':168B 'evad':100B 'expertcopyfilesintomultiplefolderslite.msi':112B 'explorer.exe':140B 'fake':7A 'fetch':103B 'fingerprint':151B 'gpt':9A,71B 'gpts':36A 'hidden':115B 'host':153B 'inject':138B 'instal':20A 'integ':98B 'ip':94B 'key':150B 'legitim':109B 'like':177B 'live':48B 'loader':22A,31A,54B,131B 'lure':60B 'malici':4A,62B,69B 'msi':105B,118B 'oct':45B 'one':142B 'page':10A,72B 'past':15A,79B 'patch':132B 'path':172B 'payload':113B 'persist':146B 'plain':97B 'pose':107B 'powershel':17A,81B,129B 'powershell':33A 'r':88B 'reach':58B 'refer':163B 'report':43B 'romulus':21A,30A,53B 'romulusloader':29A 'run':85B,123B 'runonc':149B 'runtimebroker.exe':137B 'scridea':159B 'sector':181B 'send':155B 'server':93B 'softwar':110B 'sometim':106B 'string':162B 'suspend':136B 'tabl':121B 'techniqu':145B 'theft':175B 'told':77B 'trick':11A 'unit':23A,41B 'unknown':182B 'user':13A 'vbscript':125B 'via':3A 'victim':57B,178B 'warn':40B 'websit':66B 'win':87B 'window':12A,56B 'windows':32A 'write':91B","nicknames":["RomulusLoader","Romulus Loader"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["chatgptcustomgpts","customgpts","powershell","romulusloader","windows"],"ptokens":["chatgpt","custom","gpts","powershell","windows"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"phishing","first_public_at":"2026-10-31T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-77axcf","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt","severity":null,"published_at":"2026-10-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-05T01:49:21+00:00","fetched_at":"2026-11-05T01:49:21+00:00","note":null,"cites":["https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt"]}],"documents":[{"id":71829,"url":"https://x.com/Unit42_Intel/status/2118148556888416723","title":"@Unit42_Intel: A #ClickFix campaign pushing #RomulusLoader spans multiple sites and uses these ","kind":"post","source":"x","publisher":null,"text":"A #ClickFix campaign pushing #RomulusLoader spans multiple sites and uses these techniques during delivery: C2 IP address as a plain integer, MSI Binary table steganography, AMSI patched in a suspended process & 10 injection techniques. More info at https://t.co/S9eEUa8qY9 https://t.co/2w57f7iGIU\n\nlikes 24 reposts 5","published_at":"2026-11-05T01:09:03+00:00","relation":"describes","confidence":null,"note":null},{"id":72036,"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt","title":"Unit 42: 2026-10-31 Romulus Loader spread via ClickFix technique","kind":"blog","source":"analyst","publisher":null,"text":"Unit 42 (Abhiram Patiballa, Saide Sheikh): ClickFix campaign spreading Romulus Loader. Delivery via malicious ads on compromised websites and custom GPT pages; victim pastes PowerShell into Win+R. PowerShell uses C2 IP as decimal integer (e.g. hxxp://2549127012/app/222a8c21d35e/ExpertCopyFilesIntoMultipleFoldersLite.msi = 151.240.151[.]100) to fetch MSI; MSI Binary table holds three stages, VBScript custom actions, PowerShell a.ps1 in %TEMP% with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden; reflective PE load, AES-256-CBC shellcode; AMSI patched in suspended RuntimeBroker.exe; 10 injection techniques, default target explorer.exe; persistence RunOnce; C2 hxxps://scridea[.]com/nfront.php, UA Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68; recon via ipinfo[.]io. Panel 151.240.151[.]223. Lure URLs: chatgpt[.]com/g/g-6abc09fdfb9081918c1ad488786899ef-plus-5-6, sites.google[.]com/view/antibot172881. Domains: 26-1167[.]com, cloubflare[.]net, coloperia[.]ru, de.lkjasdhf[.]sbs, havelbeenpwned[.]net, jasminebeltran[.]design, towerrush[.]cam, www.ifyvhody[.]top. IPs: 2.27.248[.]127, 23.94.145[.]88/.115/.201/.224/.229, 86.109.75[.]7/.12, 91.92.43[.]242, 93.152.224[.]118, 96.62.224[.]81, 151.240.151[.]223, 167.148.201[.]191/.224. SHA-256: 253d24c32887aa47244e2a14573dd54a2e458d9d5746a0e9eac4acbd216618d7 (3574378_1_-setup.msi), 4455bd9fe82371d5f462c724df2005ea75083adbc7025014276acc0c21aa761b (VBS), ee044381cf31255c115e8407a1fdf6168faf8df60cb4c6c71995979844a8b0ed (PS1), 1fa8d8fe397706f55fe93ace8a4e19ae06d52d5affa078e7d9d9b56ac205a38a (PE). Infrastructure live at time of writing; MSI hash changes per request.","published_at":"2026-10-31T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}