Tech News, New Delhi: Cybersecurity experts have issued a warning about a sneaky new malware campaign named ROMULUS. Instead of directly breaking into company systems, hackers are using a clever psychological trick known as “ClickFix” to convince employees to infect their own computers.
How the Scam Unfolds
- The Fake Error: A user visits a compromised or malicious website and sees an urgent pop-up message. It often mimics a standard CAPTCHA (“Verify you are human”) or an update error for tools like Google Meet or web browsers.
- Hidden Code: The webpage instructs the user to click a “Fix Error” button. Clicking this silently copies a malicious command to the user’s clipboard.
- Self-Infection: The site then prompts the user to press
Win + Ron their keyboard, paste the copied text (Ctrl + V), and hit Enter. Because the action is performed manually by an authorized user, security software often fails to flag it as an attack.
Bypassing Security Scanners
Security researchers at Forescout’s Vedere Labs found that attackers are artificially bloating malware files to massive sizes—often exceeding 800 MB. Most automated antivirus scanners skip deep scans on extremely large files to save system performance, allowing the payload to slip through unnoticed. Once inside, ROMULUS acts as a gateway to steal passwords, exfiltrate sensitive files, or download ransomware.
How to Stay Safe
- Never Run Copied Commands: Legitimate websites, CAPTCHAs, or meeting platforms will never ask you to open your computer’s terminal or Run prompt to fix a browser issue.
- Be Skeptical of Pop-Ups: Avoid clicking on unexpected browser warnings that demand immediate troubleshooting steps.
- Alert IT Teams: If an employee accidentally pastes and runs any script from a webpage, the organization’s security team should be notified immediately to isolate the device.
