Criminals are using a signed Siemens app to load malware from fake CAPTCHA pages. Update it and hunt by folder

Siemens Software Center is the Windows app engineers use to download and license Siemens software. Criminals have been bundling a genuine, signed copy of it with their own DLLs and getting it onto PCs through fake “I am not a robot” prompts.

Siemens confirmed the abuse on Monday. Its fix shipped last week, but the attack works on PCs that never had Siemens software, so updating is only part of the answer.

The Siemens file on an infected PC is real and properly signed. Look for where it is running from, not what it is.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A signed Siemens app is being used to load ClickFix malware

Siemens published advisory SSA-580366 on October 15 for CVE-2026-110936: Software Center loads DLLs from an uncontrolled search path, so a crafted DLL placed in a searched folder runs with the app’s privileges. Siemens rates it 8.4 under CVSS 4.0. Version 4.0.9.8 fixes it, and existing installs update the next time they start.

On October 19 Siemens added a blog post confirming active exploitation and linking it to Romulus, a multi-platform ClickFix campaign. The attackers distributed a bundle called AllMyBasic.msi outside Siemens channels. Siemens says no Siemens system, product or update channel was breached, to its knowledge.

Windows PCs that never had Siemens software can still be hit

ClickFix lures get users to paste a command into Win+R or PowerShell. Here that command installs a trusted, signed program that then loads the attacker’s code, which helps it get past tools that trust signed files.

Siemens says the warning signs include Siemens Software Center in the start-up apps of a PC that never had it, a SM Software Provisioning Service folder under AppData\Local\Programs, and an FTSuite folder with ftc.uml under AppData\Local. Huntress, whose researcher reported the flaw, has responded to at least 40 incidents in a related ClickFix campaign that abused signed Canon and Stardock programs, SecurityWeek reports.

Update Software Center and hunt for the folder, not the hash

• Make sure every legitimate Software Center install is on 4.0.9.8 or later. Starting the app applies the update.
• Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 at the proxy and firewall.
• Search EDR for SiemensSoftwareCenter.exe running from AppData\Local\Programs with msiexec as its parent.
• On a hit, isolate the PC, stop the process, remove the start-up entry and scheduled task, and reset the user’s passwords, as Siemens advises.

Details

• CVE-2026-110936: uncontrolled search path element (CWE-427). CVSS 4.0 score 8.4; CVSS 3.1 score 6.7. Siemens SSA-580366, published October 15, updated October 19.
• Affected: Siemens Software Center, all versions before 4.0.9.8.
• Hashes (Siemens): AllMyBasic.msi f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a; archive.dll 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491.

Hunt / verify

• Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
• Network connections to 96.62.218[.]59 or lookups of wizardexpensive[.]com.
• Run-box or PowerShell history showing pasted commands that fetch an MSI.

Source: Siemens SSA-580366; Siemens ProductCERT blog, October 19, 2026

Sources

• Siemens: SSA-580366, DLL Sideloading Vulnerability in Siemens Software Center
• Siemens ProductCERT: Active Exploitation of CVE-2026-110936 in Siemens Software Center
• SecurityWeek: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].