ClickFix Crews Hijack a Signed Siemens Installer to Drop a Remote Access Trojan

A trusted, digitally signed application has become the latest delivery vehicle for ClickFix campaigns. Siemens has released a fix for a DLL sideloading flaw in Siemens Software Center, tracked as CVE-2026-110936 (CVSS v4: 8.4). Siemens says attackers have already used it to run malicious code on victims' machines.

What happened

The application loads dynamic-link libraries from a search path that isn't properly controlled. If an attacker who already has local access places a crafted DLL in one of the folders the program checks, that code runs with the same privileges as the application. Siemens fixed the issue in version 4.0.9.8 and credited Huntress Labs researcher Jose Oregon with reporting it.

In the campaigns observed so far, attackers didn't need anything exotic. They took a genuine, validly signed copy of Siemens Software Center (version 3.5.8.7), which loaded helper files from its own folder without checking them. Next to it they placed a malicious archive.dll. Because the executable is signed and trusted, it gives the attackers' payload cover.

The infection chain:

1. The victim is lured by a ClickFix prompt and told to paste and run a command "to fix" something. In some campaigns the lure came through malicious custom ChatGPT GPTs that pointed users to a fake URL.
2. The pasted command runs PowerShell, which drops an MSI installer.
3. msiexec.exe runs AllMyBasic.msi, which launches SiemensSoftwareCenter.exe.
4. The signed binary sideloads the malicious DLL, which goes on to deploy a remote access trojan.

The activity has been linked to a ClickFix delivery platform known as Romulus, which has previously been tied to distributing Legion Loader and other malware through DLL sideloading.

Why it matters

• Trust is the weapon. A signed, recognizable vendor binary is much less likely to raise alarms with users or with application-allowlisting rules.
• The user starts the attack. ClickFix gets around many perimeter controls because the victim runs the command themselves, and using AI chatbots as a lure makes it look more legitimate.
• Old versions stay useful to attackers. Patching your own installs doesn't stop someone from bringing an older, vulnerable signed copy onto a machine. Detection still matters after the update.

What to do

• Update Siemens Software Center to 4.0.9.8 or later, then start the application so the update is applied.
• Block the published indicators at your proxy, DNS and firewall:
  • 96.62.218[.]59: payload hosting and command-and-control
  • wizardexpensive[.]com: payload hosting and command-and-control
  • 2.27.248[.]127: distribution of AllMyBasic.msi
• Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs with msiexec.exe as its parent process, and for unexpected DLLs (such as archive.dll) next to signed executables in user-writable folders.
• Reduce ClickFix exposure: train staff that no legitimate site or chatbot will ask them to paste commands into Run, PowerShell or a terminal. Where possible, restrict PowerShell and the Win+R dialog for standard users.
• Watch for signed-binary abuse with EDR rules that flag trusted executables loading unsigned DLLs from user-writable folders.

Outdated, vulnerable software on endpoints and servers is exactly what continuous vulnerability scanning is built to find. Our team uses it to flag versions like pre-4.0.9.8 Siemens Software Center before attackers can turn them against you.

Source: this story was originally reported by The Hacker News (Oct 20, 2026). This article is 4Tify's independent summary and analysis.