ClickFix Campaigns Exploit Siemens DLL Sideloading Flaw

Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center (CVE-2026-110936, CVSS 8.4) that allows attackers to load malicious libraries with application-level privileges. The flaw enables local attackers to place crafted DLLs in directories the application searches without validation. ClickFix operators are actively weaponizing this weakness in real campaigns.

The attack chain begins with malicious ChatGPT Custom GPTs directing victims to ClickFix lures. Victims execute PowerShell code that deploys an MSI installer, which launches the legitimate signed Siemens Software Center binary alongside a malicious DLL named “archive.dll.” The genuine executable’s signature masks the sideloading attack, ultimately delivering a remote access trojan. The Romulus ClickFix platform coordinates this delivery infrastructure, demonstrating how attackers exploit application trust relationships to distribute loader malware.

The patch is available in version 4.0.9.8. Organizations should update immediately and monitor for suspicious process chains—specifically SiemensSoftwareCenter.exe running from AppData\Local\Programs when launched by msiexec.exe. Siemens provided command-and-control domains and distribution infrastructure indicators for threat hunting.