RomCom Malware Campaign Targets UK Organizations via Overlooked Feedback Channels
A newly uncovered cyber threat, dubbed RomCom, is exploiting a surprising attack vector: customer feedback forms. This emerging malware campaign has been stealthily targeting UK-based entities across finance, healthcare, and government sectors since April 2023.
Security analysts have traced the threat to a coordinated operation that injects malicious code through fake feedback entries. Once opened by support staff, these submissions trigger malware designed to infiltrate and remotely control enterprise systems.
Unlike typical phishing or exploit-based tactics, RomCom weaponizes a traditionally benign entry point—feedback portals. The malware’s delivery chain begins with convincingly crafted feedback disguised as genuine customer interaction. Hidden within is obfuscated JavaScript that activates a PowerShell routine, pulling the core payload from a compromised remote server.
javascript
let feedback = {
“customerName”: “James Wilson”,
“feedbackText”: “Great service overall!”
};
Upon execution, the malware installs a scheduled task masked as a routine Windows update, enabling long-term system access. From there, RomCom performs reconnaissance—logging keystrokes, capturing screens, and harvesting system metadata, all while maintaining encrypted communications with its command infrastructure, which closely mimics standard HTTPS behavior to evade detection.
RomCom’s architecture is modular, allowing attackers to deploy additional payloads based on the compromised environment’s profile. It also incorporates anti-analysis measures—terminating execution if it detects sandboxing or virtual machine environments, further complicating efforts to study or stop it.
Cybersecurity firm Bridewell was among the first to detect RomCom’s distinct infrastructure. Their findings indicate that over 30 UK organizations have already been breached, with attackers accessing internal systems and sensitive client data.
Dr. Emma Richardson, lead researcher at Seqrite, emphasized the advanced preparation behind the campaign:
“RomCom’s level of precision and evasion points to a threat actor with deep resources—likely a nation-state or sophisticated criminal group. Their ability to identify and exploit a neglected attack surface reflects extensive pre-attack reconnaissance.”
What sets this campaign apart is not just its technical sophistication, but the creative use of customer feedback mechanisms as a covert entryway. The malware’s nickname, RomCom, reflects its dual-stage strategy: the “romantic” façade of friendly user input that evolves into full command-and-control communication post-infection.
Visual Threat Chain: ‘Operation Deceptive Prospect’ Infection Pathway (Courtesy of Bridewell)
The illustrated STIX framework offers a comprehensive visualization of the threat lifecycle behind Operation Deceptive Prospect—mapping the progression from the attacker’s entry via fake feedback submissions to the eventual takeover of targeted systems. This structured representation outlines each tactical phase, including delivery, execution, persistence, and command-and-control, enabling defenders to trace the adversary’s methodology in granular detail.
Malicious Activity via Feedback Channels (Source: Bridewell)
To defend against abuse of customer feedback portals, security professionals urge organizations to harden these interfaces by enforcing rigorous input sanitation protocols, eliminating the execution of embedded JavaScript within feedback-handling platforms, and adopting application control measures to block unapproved executables.
In addition, defenders should maintain heightened vigilance for anomalies such as unexplained PowerShell usage and irregular outbound traffic—potential red flags signaling the presence of RomCom or related remote access threats.
