ClickFix Attack Abuses Siemens Software Center Flaw to Drop a Remote Access Trojan

Siemens has fixed a DLL sideloading vulnerability in its Siemens Software Center application. According to the company, the flaw has already been exploited in so-called ClickFix attacks.

The flaw

The issue is tracked as CVE-2026-110936 and carries a CVSS v4 score of 8.4 (high severity). The application loaded dynamic-link libraries from an uncontrolled search path. That allowed an authenticated local attacker to drop a specially crafted DLL into a directory the program searches and achieve arbitrary code execution with the privileges of the affected application.

The vulnerability is patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon is credited with discovering and reporting it.

How the attackers operated

In a separate alert, Siemens explained that attackers took a genuine, validly signed copy of Siemens Software Center and placed their own archive.dll next to it to trigger malicious code. They chose this program precisely because it is signed and trusted — and because version 3.5.8.7, the latest at the time, loaded helper files from its own folder without checking them.

The chain worked like this: msiexec.exe launched AllMyBasic.msi, which in turn executed SiemensSoftwareCenter.exe. The activity is attributed to a ClickFix delivery platform called Romulus, detailed by Forescout last week as being used to deliver Legion Loader and other malware via DLL sideloading.

According to Huntress, some campaigns leaned on malicious ChatGPT Custom GPTs to steer victims toward a fake URL serving a ClickFix lure. Once copied and run, it executed PowerShell code that dropped an MSI installer, which abused DLL sideloading to ultimately deploy a remote access trojan.

What to do

Siemens shared indicators of compromise: the addresses 96.62.218[.]59 and 2.27.248[.]127, plus the domain wizardexpensive[.]com. Beyond updating to version 4.0.9.8 and starting the application to apply the patch, organizations are advised to block the listed addresses and domains and to watch for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.

Source: The Hacker News