ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Cybercriminals are increasingly combining social engineering with legitimate software to bypass security defenses and deliver malware. In October 2026, Siemens disclosed active exploitation of a high-severity vulnerability in Siemens Software Center that attackers have used in ClickFix campaigns to execute malicious code and deploy remote access trojans (RATs).

The vulnerability, tracked as CVE-2026-110936, has a CVSS v4 score of 8.4. The incident highlights how trusted applications can become a vehicle for malware when they load unauthorized files.

Official reference: Siemens ProductCERT, SSA-580366, DLL Sideloading Vulnerability in Siemens Software Center. productcert.siemens.com/productcert/html/ssa-580366.html

The flaw involves DLL sideloading, a technique in which attackers place a malicious Dynamic Link Library (DLL) where a legitimate application may load it. According to Siemens, the affected software searched an uncontrolled directory for DLL files, allowing an authenticated local attacker to place a specially crafted DLL in a searched location.

When the application loads the malicious library, the attacker's code can execute with the privileges of the affected application.

Siemens identified version 3.5.8.7 as a vulnerable version used in the observed activity. The vulnerability has been addressed in Siemens Software Center version 4.0.9.8. Security researcher Jose Oregon of Huntress Labs was credited with discovering and reporting the issue.

The reported campaign combines user manipulation with abuse of legitimate software. First, victims encounter a ClickFix lure that encourages them to copy and execute instructions, often through a deceptive webpage. Some campaigns reportedly used malicious ChatGPT Custom GPTs to direct users toward fake URLs hosting these lures.

The instructions execute PowerShell commands that download an MSI installer named AllMyBasic.msi. The installer then launches SiemensSoftwareCenter.exe, using the trusted application as a carrier for a malicious DLL named archive.dll.

Because the executable is legitimately signed and trusted, the technique may make the activity harder to distinguish from normal software execution. The ultimate objective is to deploy a remote access trojan, potentially giving attackers unauthorized access to an infected system.

The activity has been associated with Romulus, a ClickFix delivery platform previously reported in campaigns distributing Legion Loader and other malware.

Siemens shared the following indicators associated with the reported activity. These indicators can help security teams investigate potentially affected systems.

IP address: 96.62.218[.]59

Domain: wizardexpensive[.]com

IP address: 2.27.248[.]127

Organizations should review network and endpoint telemetry for connections to these indicators and investigate suspicious execution involving msiexec.exe and SiemensSoftwareCenter.exe, particularly when the executable runs from an unexpected user-profile directory.

Indicators can change over time. Validate them against current threat intelligence and organizational context before applying blocking rules.

Update Siemens Software Center: Install version 4.0.9.8 or later and launch the application to apply the update.

Block malicious indicators: Add the reported IP addresses and domain to appropriate security controls after validating organizational requirements.

Investigate suspicious processes: Look for SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec.exe.

Educate employees: Warn users against copying commands from unfamiliar websites or executing unexpected scripts. Legitimate CAPTCHA checks should not require users to paste commands into PowerShell or the Windows Run dialog.

Strengthen endpoint monitoring: Investigate unusual PowerShell activity, unexpected MSI installations, and suspicious DLL loading.

If compromise is suspected, follow the organization's incident response procedures, investigate affected endpoints, and isolate systems when necessary.

The Siemens Software Center incident demonstrates how ClickFix social engineering and DLL sideloading can combine to turn trusted software into a malware delivery mechanism. Timely patching, endpoint monitoring, and employee awareness are essential to reducing exposure.

AESPARROW CONSULTING PVT. LTD. recommends proactive vulnerability management and threat monitoring to help organizations detect suspicious activity before it leads to a wider compromise.

For technical details, affected versions, and official remediation guidance, consult Siemens ProductCERT Advisory SSA-580366: productcert.siemens.com/productcert/html/ssa-580366.html