A fake CAPTCHA asks the visitor to press Win+R, paste a command and hit Enter. A few seconds later a genuine, validly signed copy of an industrial software vendor's download manager is running from the user's AppData folder. The program hasn't been tampered with. The malicious code is in a DLL sitting next to it, and the program loads it at start-up.
That chain combines two recent disclosures. On 15 October, Forescout's Vedere Labs published an analysis of ROMULUS, a reusable back end that serves ClickFix payloads. The same day, the vendor published advisory SSA-580366 for CVE-2026-110936, a DLL sideloading flaw in its software manager. On 19 October it confirmed active exploitation, with the malicious installer delivered from one of the ROMULUS servers.
What happened
The delivery platform
Forescout found a dark-themed login panel titled "ROMULUS" while investigating an incident, then found it running on six IP addresses. The panel hands out PowerShell staging scripts at /s/<token> and trojanised MSI installers at /app/<token>, with 12-character hex tokens that probably identify a victim or campaign. A statistics page tracks installs, runs and countries. Forescout describes it as "a reusable delivery backend rather than a single hard-coded malware server" and couldn't say whether it's private, rented out, or copied between operators.
Forescout analysed two routes:
- Route A: the staging script downloads a trojanised MSI for a legitimate privilege-management utility and runs it silently with
msiexec. The utility's signed executable then loads a patched DLL, which loads the actual loader,I++u.dll. - Route B: the script hides its window, downloads the legitimate
7zr.exeand an encrypted archive, and unpacks nested password-protected layers to an executable padded to around 842 MB, which is big enough that many scanners skip it. Inside is LegionLoader, which can steal data stored in Chrome and talks to its command server over RC4 and Base64.
The signed software manager
The vendor's advisory describes CVE-2026-110936 (CVSS v4.0 8.4) as an uncontrolled search path issue: version 3.5.8.7 and earlier loaded helper DLLs from their own folder without checking them. The researcher who reported it is from Huntress. Attackers bundled a genuine copy with a malicious archive.dll in an installer called AllMyBasic.msi, distributed from 2.27.248[.]127, one of the ROMULUS servers. The vendor says none of its own systems or update channels were breached. Version 4.0.9.8 fixes the flaw, and existing installs update themselves the next time they start.
If you need a refresher on why a signed program will happily run an attacker's DLL, our guide to DLL sideloading covers the Windows search order.
Who should act
Anyone, frankly. ClickFix lures reach ordinary users through compromised websites, fake CAPTCHAs and malicious search ads, and the payloads don't depend on what software you already run. Engineering and manufacturing organisations that use the vendor's software have a second reason to check, because a copy appearing in a user's AppData folder is easier to overlook there.
Hunting in Defender and Sentinel
These queries use Microsoft Defender XDR advanced hunting tables, which are also available in Sentinel through the Defender XDR connector. Treat them as starting points to tune. The vendor's own advice applies: detect on folder location and behaviour, not on the hash of the signed executable, because that file is genuine.
1. The ClickFix moment: Run box to PowerShell
Commands typed into Win+R are recorded under the user's RunMRU key, and the process tree shows explorer.exe starting PowerShell with a URL in the command line.
union
(DeviceRegistryEvents
| where RegistryKey has @"\Explorer\RunMRU"
| where RegistryValueData has_any ("powershell", "mshta", "curl", "http")
| project Timestamp, DeviceName, Evidence = RegistryValueData),
(DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-w hidden", "-windowstyle hidden", "-ep bypass", "-nop")
| where ProcessCommandLine has "http"
| project Timestamp, DeviceName, Evidence = ProcessCommandLine)
| order by Timestamp desc2. URLs written as a decimal IP address
Forescout saw staging URLs that wrote the IP address as a single decimal number, which slips past simple IP matching.
DeviceProcessEvents
| where ProcessCommandLine matches regex @"https?://\d{8,10}(/|:|\s|$)"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName3. The signed software manager started by msiexec from AppData
DeviceProcessEvents
| where FileName =~ "SiemensSoftwareCenter.exe"
| where FolderPath has @"\AppData\Local\Programs\"
| where InitiatingProcessFileName =~ "msiexec.exe"
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName4. The sideloaded DLLs and dropped files
union
(DeviceImageLoadEvents
| where FileName in~ ("archive.dll", "DeElevator64.dll", "I++u.dll")
| where FolderPath has @"\AppData\"
| project Timestamp, DeviceName, Evidence = strcat(InitiatingProcessFileName, " loaded ", FileName), FolderPath),
(DeviceFileEvents
| where FileName in~ ("statinfosta.DB", "activate.bak", "ftc.uml", "AllMyBasic.msi", "IconEdit2Turb.msi")
or FolderPath has @"\SM Software Provisioning Service\"
| project Timestamp, DeviceName, Evidence = FileName, FolderPath)
| order by Timestamp asc5. Published indicators
From the vendor's notice and Forescout's report. The full Forescout table has more hashes and URLs.
let IPs = dynamic(["96.62.218.59", "2.27.248.127", "96.62.224.81", "86.109.75.7",
"151.240.151.223", "23.94.145.224", "93.152.224.118"]);
let Domains = dynamic(["wizardexpensive.com", "smashshape.com", "orbitflownetwork.lol", "novatrafficcore.lol"]);
let Hashes = dynamic([
"f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a",
"3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491",
"91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2",
"3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621",
"0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f"]);
union
(DeviceNetworkEvents
| where RemoteIP in (IPs) or RemoteUrl has_any (Domains)
| project Timestamp, DeviceName, Indicator = coalesce(RemoteUrl, RemoteIP), Detail = InitiatingProcessFileName),
(DeviceFileEvents
| where SHA256 in (Hashes)
| project Timestamp, DeviceName, Indicator = SHA256, Detail = FolderPath)
| order by Timestamp asc6. LegionLoader check-ins
If you have proxy logs in Sentinel, look for POST requests to /nfront.php or /nback.php, and for non-browser processes reading Chrome's Local State file.
DeviceFileEvents
| where FileName =~ "Local State" and FolderPath has @"\Google\Chrome\User Data\"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "explorer.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPathWhat to do if you find it
- Isolate the device and keep copies of the installer, the folder holding the signed executable, and any scheduled task or startup entry that launches it.
- Stop the process before removing persistence, as the vendor advises, then remove the startup entry and scheduled task.
- Reset the user's passwords and revoke their sessions, and treat browser-stored credentials and cookies as stolen. LegionLoader targets Chrome's stored data.
- Block the indicators at your firewall, proxy and DNS resolvers, and add them to Defender as custom indicators.
- Update legitimate installs of the software manager to 4.0.9.8 or later by starting them, and only download it from the vendor's support site.
Stopping the next one
ClickFix works because a user runs the command, so email and download controls never see a file. The controls that help sit on the endpoint: restricting the Run dialog where people don't need it, PowerShell script block logging (event 4104) and Constrained Language Mode, attack surface reduction rules in Defender for Endpoint, and App Control policies that stop software running from user-writable folders. Users also need one simple rule: a real CAPTCHA never asks you to paste anything into Windows. We cover the controls in more depth in our ClickFix explainer, and in earlier posts on ClickFix and HijackLoader and FileFix.
How a managed SOC helps
- Behaviour over hashes. A signed program started by
msiexecfrom a user's AppData folder, then loading an unsigned DLL, is suspicious whatever its fingerprint. CYBERSHIELD AI's Investigation Agent works alerts like this to a verdict in an average of 3m 30s, or 7m 50s where Advanced Investigation is needed. - People on shift when it lands. Our SOCs are manned 24/7 with senior analysts and incident responders, and senior analyst sign-off is the default on the managed service.
- Hunts when research drops. Reports like Forescout's become a hunt across your estate, not a bookmark.
If you'd like a second pair of eyes on what's running from your users' AppData folders, talk to our team.