ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens Confirms Active ClickFix Exploitation of a Signed Software Center Binary

Siemens has confirmed that a DLL sideloading vulnerability in its Software Center application, tracked as CVE-2026-110936 (CVSS v4.0 score of 8.4, High), is being actively exploited in the wild as part of ClickFix-style social-engineering attacks that ultimately deploy a remote access trojan (RAT). The company disclosed the flaw in advisory SSA-580366 on October 15, 2026, updated it on October 17 to announce the fix in version 4.0.9.8, and on October 19 added a link to a new Siemens blog post confirming in-the-wild exploitation — the first public acknowledgment that attacks were already underway. The same day, the Canadian Centre for Cyber Security issued its own advisory, AV26-1063, citing Siemens' bulletin and warning administrators about the ongoing campaign.

Attackers linked to a ClickFix delivery toolkit known as Romulus paired a genuine, digitally signed copy of Siemens Software Center with a malicious DLL file, exploiting the application's failure to validate helper libraries before loading them. Siemens was direct about why its software was chosen as the vehicle: the company said attackers "chose this program as a carrier because it is signed and trusted," which helps the malicious loader slip past endpoint security tools that extend trust to processes bearing a legitimate code-signing certificate. Siemens emphasized that its own infrastructure was not the point of compromise, stating, "No Siemens system, product or update channel was breached to our knowledge."

Incident Details

Attribute	Value
CVE ID	CVE-2026-110936
CVSS Score	8.4 (High, CVSS v4.0) / 6.7 (Medium, CVSS v3.1)
Weakness Class	CWE-427: Uncontrolled Search Path Element (DLL sideloading)
Vendor	Siemens
Affected Product	Siemens Software Center
Affected Versions	All versions up to and including 3.5.8.7
Patched Version	4.0.9.8 and later (auto-updates on next application launch)
Attack Vector	Local — requires a malicious DLL to be placed in the application's search path, achieved here via ClickFix social engineering rather than remote network access
Exploitation Status	Confirmed active exploitation as of October 19, 2026
Siemens Advisory	SSA-580366 (published October 15, updated October 17 and October 19, 2026)
Government Advisory	AV26-1063 — Canadian Centre for Cyber Security (October 19, 2026)
Payload	Remote access trojan, delivered via the Romulus ClickFix platform (associated with LegionLoader malware)
Known IOCs	IPs 96.62.218[.]59 and 2.27.248[.]127; domain wizardexpensive[.]com; files AllMyBasic.msi and archive.dll

What Happened

The ClickFix Lure and Delivery Chain

ClickFix attacks rely on fake prompts — commonly a bogus CAPTCHA or "verify you are human" screen — that walk victims through manually copying and running attacker-supplied commands, framing the step as a simple fix for a fake error rather than a visible malware install. In this campaign, victims landed on ClickFix pages through multiple referral paths; a related campaign tracked separately by incident responder Huntress used rogue ChatGPT Custom GPTs to redirect users toward ClickFix pages, a technique Huntress tied to more than 40 separate incidents it responded to in late September 2026.

Once a victim followed the ClickFix prompt, the lure walked them through pasting and executing PowerShell code. That PowerShell stage retrieved and launched an MSI installer (observed as AllMyBasic.msi), which in turn invoked the legitimate, signed SiemensSoftwareCenter.exe via msiexec.exe. Critically, the attackers staged a malicious file named archive.dll in the same directory as the legitimate Siemens binary. Because Software Center loads helper DLLs from an uncontrolled search path without validating them first, the application executed the attacker's archive.dll with its own process privileges — a textbook DLL sideloading chain that used a trusted, signed vendor binary as the launch vehicle for the final payload, a remote access trojan.

Abusing a Signed, Trusted Binary

The core defect behind CVE-2026-110936 is straightforward: Software Center searches for and loads certain DLLs without confirming they came from Siemens or carry a valid signature of their own. An attacker who can place a crafted DLL anywhere in that search path — in this case, by tricking a ClickFix victim into running the commands that stage it — gets arbitrary code execution under the privileges of the Software Center process. Because the parent executable is a genuinely signed Siemens binary, security tools that apply looser scrutiny to signed, well-known applications may not flag the sideloaded DLL's activity as readily as they would an unsigned standalone executable, giving attackers a modest evasion advantage on top of the social-engineering delivery.

Romulus: The Platform Behind the Campaign

Siemens and outside researchers have linked the campaign to Romulus, a multi-platform ClickFix delivery toolkit previously documented by researchers at Forescout. Romulus is capable of serving a range of malware payloads, including LegionLoader, and functions as infrastructure that can be reused across multiple intrusion sets rather than a single group's exclusive tool. Forescout's research notes it could not pin down who actually operates Romulus, stating it "could be a private tool, a service sold to cybercriminals, an affiliate program, or software copied by different threat actors." That ambiguity means this campaign should be read as abuse of shared ClickFix infrastructure rather than the work of a single, named, attributable group. Siemens says it is sharing indicators of compromise and threat intelligence with law enforcement and EDR vendors to support broader detection.

Siemens' Patch and Advisory Timeline

Siemens' disclosure evolved in three steps over five days. The vulnerability was first published on October 15, 2026 in SSA-580366 with the CVSS v4.0 score of 8.4 but no fix yet available. Two days later, on October 17, Siemens updated the same advisory to announce that version 4.0.9.8 resolved the flaw, noting that installations already in place would receive the update automatically the next time a user launched Software Center — no manual reinstall required. It was not until October 19 that Siemens amended the advisory again to link to a new blog post acknowledging that the flaw had already been exploited in the wild, confirming that attacks predated the public fix.

Impact Assessment

Impact Area	Description
Scope	Any Windows endpoint with Siemens Software Center version 3.5.8.7 or earlier installed, targeted via ClickFix social engineering
Attack Complexity	Requires successful social engineering to get a victim to execute attacker-supplied commands; the DLL sideloading step itself is simple once the malicious files are staged locally
Authentication Barrier	None from a network perspective — exploitation occurs entirely on the local endpoint after the ClickFix lure succeeds
Detection Evasion	Malicious DLL execution is cloaked behind a legitimately signed, trusted Siemens process, reducing the odds that endpoint tools flag it as readily as an unsigned binary
Business Impact	Full remote access to the compromised endpoint via a RAT, with downstream risk of credential theft, lateral movement, and data exfiltration
Industrial Context	Siemens Software Center is used to manage software and licensing across Siemens industrial and automation product lines, giving attackers a potential foothold on engineering workstations in OT-adjacent environments
Vendor Infrastructure Risk	None confirmed — Siemens states no Siemens system, product, or update channel was itself breached

Recommendations

For IT Admins

Update Siemens Software Center to version 4.0.9.8 or later immediately; existing installations will auto-update on next launch, but admins should verify version numbers across the fleet rather than assume the auto-update has reached every endpoint.
Hunt for the known indicators of compromise: the files AllMyBasic.msi and archive.dll, outbound connections to 96.62.218[.]59 and 2.27.248[.]127, and DNS lookups for wizardexpensive[.]com.
Audit endpoints — especially engineering and OT-adjacent workstations running Siemens tooling — for unexpected msiexec.exe child processes spawning SiemensSoftwareCenter.exe outside of normal patch or install windows.
Restrict user ability to execute PowerShell from the Run dialog or clipboard-pasted commands where feasible, since this is the entry point ClickFix lures depend on.

For Security Teams

Treat any successful ClickFix interaction (a user pasting and running commands from a browser prompt) as a potential precursor to this attack chain, regardless of which application is ultimately sideloaded.
Review EDR and allow-listing policies that extend elevated trust to signed binaries; this campaign specifically exploits the assumption that a signed, well-known vendor process is inherently safe to ignore.
Block or alert on the published IOCs at the network perimeter and in DNS logs, and share internal detections with Siemens or your EDR vendor given Siemens' stated intelligence-sharing effort.
Monitor for follow-on RAT activity — command-and-control beaconing, credential dumping, or lateral movement tooling — on any host where the sideloading chain is confirmed, since the DLL sideloading step is only the initial access stage.

For End Users

Never copy and paste commands into a terminal, Run dialog, or PowerShell window because a website told you to "fix an error" or "verify you're human" — this is the core ClickFix social-engineering pattern and no legitimate CAPTCHA or security check requires it.
Be skeptical of links to run software "fixes" surfaced through chatbots or custom GPTs, which have been used in related campaigns to funnel victims toward these same ClickFix pages.
Report unexpected installer prompts or unfamiliar MSI packages to IT rather than proceeding through them independently.

Key Takeaways

CVE-2026-110936 is a DLL sideloading flaw (CWE-427) in Siemens Software Center, carrying a CVSS v4.0 score of 8.4 (High), and is confirmed under active exploitation as of October 19, 2026.
Attackers paired a genuine, digitally signed copy of Software Center with a malicious archive.dll, letting the sideloaded payload execute under the trust extended to a signed vendor binary.
The infection chain ran through a ClickFix lure, PowerShell execution, an MSI installer (AllMyBasic.msi), and msiexec.exe launching the vulnerable Siemens binary — ultimately deploying a remote access trojan.
The campaign is linked to Romulus, a reusable, multi-payload ClickFix delivery platform documented by Forescout; researchers could not attribute Romulus to a single named threat actor.
Siemens fixed the flaw in version 4.0.9.8, which auto-updates on next launch, but the advisory wasn't amended to disclose active exploitation until four days after the initial October 15 publication.
Siemens confirmed its own infrastructure was not compromised — the attack abuses a legitimately distributed, signed application rather than a tainted update channel.