How ClickFix Attackers Used a Siemens Software Center Vulnerability to Deploy Remote Access Trojans

Siemens Software Center, a legitimate platform used by organizations to manage and deploy Siemens software, contains a DLL sideloading flaw that allows attackers to hijack the application's startup process. When the application searches for its required dynamic link libraries (DLLs), it does not validate the source or integrity of those files. An attacker who can place a malicious DLL in one of the directories the application searches can force the legitimate Siemens executable to load and run that malicious code instead.

ClickFix campaigns have weaponized this flaw to deliver remote access trojans (RATs) onto systems. The attacker first gains initial access through a phishing email, social engineering, or another vector that convinces a user to run a downloader script or executable. That script then places the malicious DLL on the system, often in a temporary directory or in the application's installation folder. When Siemens Software Center launches, it executes the attacker's code without any warning or user interaction beyond the initial infection.

DLL sideloading is a technique older than many modern malware families, yet it remains effective because it relies on a legitimate application's trust in the Windows search path. When an application needs a library, the operating system checks a specific order of directories: the application directory first, then system directories, then the user's PATH environment variable. If the attacker can write a file to one of these locations before the legitimate application starts, the DLL will be loaded and executed with the same security context as the application itself.

In the case of Siemens Software Center, the vulnerability is compounded because the application likely runs with elevated privileges or has access to sensitive system resources. An attacker who successfully sideloads a malicious DLL gains not just code execution, but code execution at a privilege level that gives them meaningful control over the system. This is why industrial software is such an attractive target: compromise of a single workstation can cascade into access to manufacturing networks, SCADA systems, or sensitive engineering data.

ClickFix is a known malware family and delivery mechanism that has been linked to several prolific threat actors over the past few years. The campaign exploits urgent-sounding social engineering tactics, often masquerading as browser warnings or software update prompts to trick users into executing malicious scripts. Once the initial script runs, it downloads and installs the RAT, establishing persistence and command-and-control communication with attacker infrastructure.

By chaining the ClickFix delivery mechanism with the Siemens Software Center vulnerability, attackers have a reliable way to breach organizations that depend on Siemens products. The RAT deployed this way can log keystrokes, exfiltrate files, capture screenshots, and allow the attacker to move laterally through the network. Because the malware executes at application privilege level and the initial infection often goes unnoticed by the user, incident response teams may not detect the breach until data exfiltration or lateral movement becomes visible.

DLL sideloading vulnerabilities are not eliminated by a single patch; they reflect a broader design pattern in how Windows applications load libraries. According to security vendor incident reports, sideloading flaws continue to be discovered in software from major vendors because the underlying mechanism is built into the Windows API itself. Many developers do not prioritize validating the source of loaded libraries, especially if the application is not designed for high-security environments.

From a law-enforcement perspective, ClickFix campaigns are often traced back to financially motivated threat actors or state-sponsored groups. Public law-enforcement press releases and intelligence briefings note that these campaigns target both consumer and enterprise users, suggesting a diversified attack portfolio rather than a single objective. The fact that Siemens, a company with a strong security posture, issued a fix for this vulnerability highlights that no vendor is immune to design flaws in their dependency management.

The ecosystem context matters: industrial software vendors often maintain backward compatibility and ease of deployment as priorities, which can conflict with strict security controls. Organizations running Siemens Software Center on systems that also connect to operational technology (OT) networks face compounded risk. A breach at the IT/OT boundary can be especially damaging because the same credentials or pivot points used to compromise the Siemens workstation might grant access to control systems that were never meant to be internet-exposed.

Siemens released a patch for CVE-2026-110936 as soon as the vulnerability was disclosed. Organizations should apply this patch as a priority, especially to any systems running Siemens Software Center in production environments or connected to sensitive networks. Before applying patches, create a backup or test the update in a non-production environment to ensure it does not interfere with existing deployments.

Beyond the patch, several measures reduce exposure:

1. Restrict write access to directories where Siemens Software Center searches for libraries, especially the application installation folder.
2. Use application whitelisting or endpoint detection and response (EDR) tools to monitor for unexpected DLL loading or process behavior from Siemens Software Center.
3. Disable or isolate the automatic update feature if Siemens Software Center can be triggered remotely, and require explicit user action or administrative approval before launching the application.
4. Monitor for ClickFix-related phishing emails by training users to recognize urgency-driven social engineering tactics and by implementing email filtering rules that flag suspicious attachments or links.
5. Segment networks so that workstations running Siemens Software Center do not have direct access to OT systems or sensitive data repositories.

This incident is a reminder that DLL sideloading is a persistent attack vector that is not unique to Siemens. Any application on Windows that loads libraries without validating their source is a potential target. Organizations that deploy software from vendors in the industrial automation, CAD, financial services, or government sectors should treat DLL sideloading as a threat model and work with their security teams to understand which applications in their environment are vulnerable and which directories attackers could manipulate.

ClickFix campaigns are also a case study in how phishing and social engineering remain the most cost-effective entry points for attackers. Even with all the security tools in place, a convincing fake browser warning or download prompt can still trick users into running malware. The ClickFix actors have proven they can adapt their delivery methods to target whatever software stack exists in their target environment, making defense a layered and ongoing process rather than a one-time fix.

Check whether your organization runs Siemens Software Center, and if it does, verify that the CVE-2026-110936 patch has been applied. Review access controls on the application's installation directory to ensure that standard users cannot write to it. If you manage endpoint security, adjust detection rules to flag suspicious DLL loading from Siemens Software Center or unexpected network connections initiated by that process. Finally, remind users that download prompts and browser warnings are a common phishing tactic; legitimate software updates come through official channels and should never require running a script directly from a download or email attachment.