--- id: "CMP-202611-77axcf" kind: "campaign" aliases: [] title: "ClickFix campaign via malicious ads and fake custom GPT pages tricks Windows users into pasting a PowerShell command that installs Romulus Loader (Unit 42)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "other" products: [{"name": "Windows", "fixed": [], "vendor": "Microsoft"}, {"name": "PowerShell", "fixed": [], "vendor": "Microsoft"}, {"name": "ChatGPT custom GPTs", "fixed": [], "vendor": "OpenAI"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: "2026-10-31T00:00:00+00:00" first_seen_at: "2026-11-05T01:49:21+00:00" updated_at: "2026-11-05T01:49:40+00:00" sources: [{"source": "analyst", "url": "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt", "first_seen_at": "2026-11-05T01:49:21+00:00", "cites": ["https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt"]}] exploit_sources: [] --- # RomulusLoader: ClickFix campaign via malicious ads and fake custom GPT pages tricks Windows users into pasting a PowerShell command that installs Romulus Loader (Unit 42) Unit 42 reports (31 Oct 2026) a live ClickFix campaign that delivers Romulus Loader on Windows. Victims reach the lure through malicious ads on compromised websites or through malicious custom GPT pages on chatgpt.com, and are told to paste a PowerShell command into the Run dialog (Win+R). The command writes the server IP as a plain integer to evade detection, then fetches an MSI (sometimes posing as legitimate software, e.g. ExpertCopyFilesIntoMultipleFoldersLite.msi). Payloads are hidden in the MSI's Binary table and run through VBScript custom actions and PowerShell. The loader patches AMSI in a suspended RuntimeBroker.exe, injects into explorer.exe with one of 10 techniques, persists through the RunOnce key, fingerprints the host and sends the data to scridea[.]com/nfront.php. Its strings reference DPAPI, app-bound encryption and browser data paths, so credential theft is likely. Victim count and sectors: unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Windows affected range not listed fixed no fixed version listed - :PowerShell affected range not listed fixed no fixed version listed - :ChatGPT custom GPTs affected range not listed fixed no fixed version listed ## How to check Look for Run-dialog (RunMRU) or PowerShell command lines containing an http URL whose host is a bare decimal number (e.g. hxxp://2549127012/app/...), or msiexec fetching an MSI from an IP. Look for a.ps1 in %TEMP% run with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden, new RunOnce entries, and HTTPS POSTs to scridea[.]com/nfront.php with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68'. Domains: 26-1167[.]com, cloubflare[.]net, coloperia[.]ru, de.lkjasdhf[.]sbs, havelbeenpwned[.]net, jasminebeltran[.]design, towerrush[.]cam, www.ifyvhody[.]top. IPs: 2.27.248[.]127, 23.94.145[.]88, 23.94.145[.]115, 23.94.145[.]201, 23.94.145[.]224, 23.94.145[.]229, 86.109.75[.]7, 86.109.75[.]12, 91.92.43[.]242, 93.152.224[.]118, 96.62.224[.]81, 151.240.151[.]100, 151.240.151[.]223, 167.148.201[.]191, 167.148.201[.]224. Lure pages: chatgpt[.]com/g/g-6abc09fdfb9081918c1ad488786899ef-plus-5-6, sites.google[.]com/view/antibot172881. SHA-256 (the MSI hash changes on every download): 253d24c32887aa47244e2a14573dd54a2e458d9d5746a0e9eac4acbd216618d7, 4455bd9fe82371d5f462c724df2005ea75083adbc7025014276acc0c21aa761b, ee044381cf31255c115e8407a1fdf6168faf8df60cb4c6c71995979844a8b0ed, 1fa8d8fe397706f55fe93ace8a4e19ae06d52d5affa078e7d9d9b56ac205a38a. ## Fix Block the listed domains and IPs. Tell users that no real website, CAPTCHA or GPT ever asks them to paste a command into Win+R or PowerShell. Where possible, turn off the Run dialog or restrict PowerShell for normal users and alert on PowerShell URLs that use a decimal-integer host. If a machine is hit, isolate it, remove the RunOnce persistence, and reset browser-saved passwords and sessions from a clean device. ## Timeline - 2026-11-05T01:49:21+00:00 analyst https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt ## Documents - [describes] @Unit42_Intel: A #ClickFix campaign pushing #RomulusLoader spans multiple sites and uses these https://x.com/Unit42_Intel/status/2118148556888416723 - [describes] Unit 42: 2026-10-31 Romulus Loader spread via ClickFix technique https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-31-Romulus-Loader-spread-via-ClickFix-technique.txt --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_