ClickFix Campaign Weaponizes Siemens Software Center DLL Sideloading Vulnerability

ClickFix is a social engineering and malware distribution campaign that has been active for several years, typically relying on fake browser alerts, support popups and deceptive download prompts to trick users into installing malicious payloads. The attackers behind ClickFix usually pose as technical support or system security warnings, creating a sense of urgency so that victims bypass normal caution. By October 2026, the campaign had evolved to exploit legitimate software vulnerabilities, moving beyond pure social engineering into supply-chain and application-specific attack vectors.

CVE-2026-110936 is a DLL sideloading vulnerability affecting Siemens Software Center, a management and distribution platform for Siemens industrial software. When Siemens Software Center starts, it searches for dynamic libraries in several directories in a specific order. If an attacker can place a malicious DLL file with the same name in one of those search paths before the legitimate library is found, Windows will load the attacker's code instead. The vulnerability carries a CVSS v4 severity score of 8.4, indicating high risk. What makes this particularly dangerous is that the malicious code executes with the same user privileges as Siemens Software Center itself, potentially allowing lateral movement or privilege escalation depending on the context in which the application runs.

Security researchers documented that ClickFix operators combined social engineering with the DLL sideloading vulnerability to distribute remote access trojans. The typical attack chain begins with a deceptive browser popup or fake tech support alert that mimics legitimate warnings about system updates or security risks. When the victim clicks on the alert, they are directed to download what appears to be a software update or patch. The downloaded file contains a specially-crafted DLL and supporting files. Once the victim extracts or executes the package, the malicious DLL is placed in a location on disk where Siemens Software Center will search for libraries. When Siemens Software Center is launched (or if it is already running and a component is refreshed), it loads the attacker's DLL instead of the legitimate library, providing a foothold for remote access tools. The attackers then use the resulting shell to establish persistence, move laterally within the network or exfiltrate data.

A typical ClickFix victim might see a browser notification claiming "Critical Windows Update Available" while visiting a compromised website or viewing an ad. The notification looks authentic, matching the style of genuine Windows alerts. Clicking it downloads a ZIP file labeled something like "Windows_Security_Update.zip" or "System_Patch_Oct2026.zip". The victim extracts the archive, which contains a folder structure that mimics legitimate software. Inside are the malicious DLL, a launcher script, and sometimes decoy files. The victim runs a setup script or clicks an installer, and the DLL is copied to a local directory. Hours or days later, when the user launches Siemens Software Center for a routine task, the malicious DLL is loaded and remote access is established. By that point, the connection between the original email or popup and the infection is no longer obvious to the user.

Siemens Software Center is used by industrial organizations, manufacturers, utilities and enterprises that rely on Siemens control systems and software licensing. An organization using Siemens Software Center is at direct risk if an employee receives a ClickFix social engineering message. Because the vulnerability allows execution at the application's privilege level, attackers can pivot toward critical systems if Siemens Software Center runs with elevated privileges or on a machine with broad network access. The vulnerability also creates a false sense of legitimacy for the attack: victims may believe they are patching software in good faith, not installing a trojan. This combination of social engineering deception and a real software flaw significantly increases the likelihood of successful infection compared to attacks relying solely on either vector.

Siemens released patches for CVE-2026-110936 shortly after the ClickFix exploitation became public. Organizations should apply these patches immediately through their normal software update channels.

1. Verify the patch version for your instance of Siemens Software Center against the official Siemens advisory
2. Test the patch in a non-production environment before deploying enterprise-wide
3. Update all machines where Siemens Software Center is installed
4. Run a network scan to check for signs of prior compromise (unusual outbound connections, unexpected remote access tools, suspicious DLL files)
5. Review logs on machines where Siemens Software Center is installed for unusual library loading or DLL load failures that might indicate a previous exploitation attempt

Beyond patching, security teams should reinforce user training on social engineering tactics. Employees should never download software or updates from browser popups or unsolicited notifications. All updates to Siemens or other corporate software should be sourced from official websites or internal IT channels, never from email links or pop-ups. Organizations running Siemens Software Center on isolated or air-gapped networks are at lower risk, though network-adjacent machines still require protection.

This incident illustrates why DLL sideloading remains a persistent and high-impact vulnerability class. Applications that search for libraries in user-writable directories (such as the application's own installation folder or the current working directory) before checking system paths are vulnerable. Developers should follow secure library loading practices: hard-code full paths to legitimate libraries or use Windows API functions that prioritize system directories. For users and system administrators, the lesson is that legitimate software vendors will never push updates through deceptive browser popups. Any pressure to download or install software outside normal channels should be treated as a red flag. Additionally, monitoring for unsigned or suspicious DLL files in application directories and setting alerts for unusual library-loading failures can catch exploitation attempts early.

What exactly is DLL sideloading and why does it work? DLL sideloading happens when a Windows application looks for library files in a series of directories in a specific order. If an attacker can place a malicious DLL with the same name in one of those directories (often before the legitimate system directory is checked), Windows loads the attacker's code instead. It works because the application trusts the file it finds and executes it with no further validation.

Do I need to be a Siemens customer to be at risk from this vulnerability? Yes, CVE-2026-110936 specifically affects users and organizations running Siemens Software Center. If your organization does not use this software, this particular vulnerability does not affect you directly, though the DLL sideloading technique is used against many other applications.

How can I tell if my machine was compromised by a ClickFix attack exploiting this flaw? Look for unexpected DLL files in the Siemens Software Center installation directory (especially unsigned or with suspicious file names or timestamps), unexpected outbound network connections originating from Siemens processes, and error messages about failed DLL loads in event logs. If you suspect infection, isolate the machine from the network and contact your security team.

Is applying the Siemens patch enough to protect me? Patching closes the vulnerability on your system, but it does not detect or remove malware that may have already been installed. After patching, scan the machine thoroughly with updated antivirus and malware tools, and monitor network activity for signs of compromise.

Why do attackers use social engineering combined with real software vulnerabilities? Combining the two tactics increases success rates. Social engineering creates urgency and trust, lowering a victim's guard. A real vulnerability makes the attack technically feasible and harder to detect because it exploits legitimate code paths rather than relying purely on social deception.

Source: The Hacker News