ClickFix just went from a trick to a delivery service. The Hacker News covered it today, with Forescout's Vedere Labs documenting ROMULUS, a ClickFix platform pushing LegionLoader.
Teach your team this today: never paste a command into Run, PowerShell, or Terminal because a web page told you to. That is the whole attack.
There is no login page and no password prompt, so the usual 'check the URL' advice misses it entirely. We tie training to the exact lure someone hit.
Have your users ever been trained to spot a paste-and-run lure?
We broke down how ClickFix works on our blog. https://phishu.net/blogs/blog-clickfix-in-the-phishu-framework.html
More like this every Monday in our newsletter. https://phishu.net/newsletter
#CyberAware #SecurityAwareness #CybersecurityAwareness #AwarenessMonth
https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
PhishUClickFix in the PhishU FrameworkA high-level look at how the PhishU Framework turns ClickFix into a point-and-click template with callback analytics, console visibility, and campaign-linked training.