ROMULUS ClickFix payload-delivery panel and its lure pages

ROMULUS is a web panel that delivers the payloads behind ClickFix lures. A fake verification page (seen on a Google Sites page linked from a malicious ChatGPT Custom GPT, and on compromised small-business websites) tells the visitor to open the Windows Run box and paste a command it has copied to the clipboard. The command fetches a PowerShell stager from a ROMULUS server, addressed as a decimal number instead of a dotted IP so that the pasted text contains no recognisable address. The stager downloads a trojanised MSI installer from /app/<12 hex>/<name>.msi and runs it silently; the installer side-loads a DLL into a legitimately signed program, and other routes deliver LegionLoader. The lure pages use an off-the-shelf fake-verification overlay kit; the most recent one hides the copied command as an index list into a scrambled alphabet that cmd.exe rebuilds with delayed expansion, so the command line itself names no PowerShell, URL or IP. This hunt matches the ROMULUS panel's login page by its page code and lure pages that carry the index-cipher command, and tracks the known panel servers and the lure loader hosts.