ClickFix Attackers Target Siemens Software Center via DLL Sideloading Vulnerability

ClickFix, a known malware operation with a track record of targeting software users through malicious pop-up redirects and social engineering, shifted tactics to exploit a previously unknown vulnerability in Siemens Software Center. Rather than relying solely on user clicks and credential theft, the attackers leveraged CVE-2026-110936, a DLL sideloading flaw that allowed them to plant malicious library files in predictable directories. When the legitimate Siemens application launched, it would load the attacker-controlled DLL instead of the genuine one, granting remote access trojan capabilities with full application privileges.

The vulnerability was patched in October after disclosure. Siemens issued an advisory confirming the flaw and releasing updates for affected versions of Software Center. However, the window between discovery and patch deployment likely allowed the attackers to compromise an unknown number of industrial and engineering users who rely on Siemens tools.

DLL sideloading exploits the way Windows applications search for library files. When a program runs, it looks for required DLLs in several standard locations: the application's directory first, then system directories, then paths listed in the environment. An attacker who can write a malicious DLL to a location the application searches can hijack the loading process without modifying the legitimate executable.

Unlike traditional privilege escalation, DLL sideloading does not require a patch or exploit to run. It simply abuses the application's normal behavior. In the Siemens case, ClickFix operators placed a crafted DLL in a directory that Software Center accessed during startup. The malware then executed with the same user privileges as Siemens Software Center itself, often administrator-level on engineering workstations.

This method is favored by attackers because detection is difficult: the legitimate application appears to be running normally, the attacker's code is not obviously malicious in memory, and security tools focused on process behavior may miss the library substitution entirely.

Once the malicious DLL loaded, the ClickFix operators gained a remote access trojan capability. This allowed them to establish command-and-control communications, exfiltrate data, or pivot to other machines on the same network. In industrial environments, a single compromised engineering workstation can expose design files, operational technology (OT) systems and sensitive manufacturing processes.

The ClickFix group has historically focused on financial fraud and credential harvesting. This shift to supply-chain exploitation and RAT deployment suggests either an evolution in their technical sophistication or a partnership with other threat actors. The attack pattern indicates staging: the attackers likely used initial social engineering or a separate vulnerability to gain filesystem write access before triggering the DLL sideloading.

Siemens Software Center is used by engineers, manufacturers and systems integrators to manage industrial automation components, firmware updates and configuration tools. Compromising these users is attractive to attackers because they often have network access to sensitive operational technology or intellectual property. A single infected engineering workstation can serve as a foothold for lateral movement into production networks.

Industrial sectors also tend to lag behind consumer software in applying patches. Legacy systems, change-management processes and continuous operation requirements mean security updates are often delayed. ClickFix attackers likely recognized this and targeted the Siemens ecosystem as a less-defended entry point compared to consumer software or cloud services.

Siemens released patches for Software Center shortly after CVE-2026-110936 was disclosed. However, applying patches to industrial software requires planning and downtime coordination. Many organizations may not have deployed the update immediately.

Detection of DLL sideloading attacks is non-trivial because the legitimate application appears to be the actor. Endpoint detection and response (EDR) tools that monitor process behavior and file operations have a better chance of catching the malicious DLL, but signature-based antivirus often misses it. Forensic investigation typically requires examining the timestamp and hash of DLL files in the application directory and comparing them against known-good binaries from official Siemens sources.

1. Verify and deploy the latest Siemens Software Center patch from the official Siemens support portal, prioritizing systems in sensitive roles.
2. Audit file permissions in Siemens Software Center installation directories to ensure that ordinary user accounts cannot write to them; if writable directories exist, implement additional monitoring.
3. Enable execution logging or EDR agents on engineering workstations to record suspicious DLL loading from non-standard paths.
4. Review network logs and firewall rules for unexpected outbound connections from Siemens Software Center processes, particularly to non-standard ports or external IP ranges.
5. If your organization uses Siemens Software Center in a critical capacity, check EDR or system logs for signs of malicious DLL files placed in application directories during the period between the vulnerability's discovery and your patch deployment.

DLL sideloading remains one of the most effective and difficult-to-detect attack methods because it turns a legitimate application into a Trojan horse. ClickFix's shift from social engineering to supply-chain exploitation shows that even specialized industrial software is not immune to sophisticated attackers. The gap between vulnerability disclosure and patch deployment is where most damage occurs. Keeping industrial software current, monitoring for suspicious process behavior, and restricting filesystem write permissions are your strongest defenses.

If you use Siemens Software Center or similar industrial tools, start by checking whether your current version includes the patch for CVE-2026-110936 today.

Source: The Hacker News