Hackers are exploiting a flaw in Siemens Software Center to install malware on PCs. Specifically, the attack uses a method called ClickFix, which tricks people into pasting harmful commands on their own computers. As a result, the malware bypasses most security tools because the user runs it themselves.
In particular, Siemens has tracked the flaw as CVE-2026-110936, with a score of 8.4 out of 10. Notably, the issue affects version 3.5.8.7, which loaded helper files without checking them first. Because of this, attackers can place a fake file next to the real app, and the software loads it automatically. Siemens has since released version 4.0.9.8 to fix the problem.
In the attack, a fake web page first asks users to paste a command into PowerShell or the Run box. After that, the command downloads an installer file called AllMyBasic.msi. The installer then launches a genuine, signed copy of Siemens Software Center. However, it also loads a malicious file named archive.dll, which gives hackers remote control of the PC.
On top of that, security firm Forescout has linked the attacks to a delivery platform called Romulus. According to Forescout, Romulus acts as a reusable backend that can deliver multiple types of malware through ClickFix tricks. In fact, researchers found that one of its payloads, called LegionLoader, can steal data from Chrome browsers. Meanwhile, some campaigns even used fake ChatGPT tools to lure victims to the malicious pages.
Huntress Labs researcher Jose Oregon first discovered and reported the flaw to Siemens. The company subsequently published its advisory on October 15 and released the fix on October 17. It then confirmed active attacks on October 19. Additionally, Siemens said that attackers did not breach any Siemens system, product, or update channel.
Therefore, Siemens urges all users to update Software Center to version 4.0.9.8 right away. The company also warned, “Never paste a command from a web page into Win+R, the Run box, or PowerShell.” In addition, it said that a real “I am not a robot” check never asks users to run commands. Furthermore, users should download Siemens software only from official sources.