Attackers abused a trusted, signed Siemens Software Center program to run malicious code and install a remote access trojan. Victims were directed to a fake web address containing a ClickFix lure, where copying and running the displayed content launched PowerShell and an installer that exploited the Siemens software flaw.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A ChatGPT Custom GPT sends you to a link. The page says: “Copy and execute.” That’s ClickFix. Running the text starts PowerShell, which downloads an MSI installer. It launches Siemens Software Center beside a malicious file called archive.dll. Here’s the trap: SiemensSoftwareCenter.exe is genuinely signed. But the installer uses a DLL sideloading flaw to run archive.dll and deliver a remote access trojan. If a page or AI assistant tells you to run text, don’t. Check the request with approved support first.
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
Researchers say a law firm was targeted with a spear‑phishing email that led staff to download an encrypted archive containing a Windows shortcut labeled like legal case files. After the user ran it and approved admin rights, the malware told Microsoft Defender to ignore a folder and a fake…
Researchers reported a real spear‑phishing intrusion against a law firm where attackers sent a message with a link to an encrypted archive. The archive contained a Windows shortcut (LNK) disguised as “Case Documents,” and running it launched a multi‑stage loader (“HollowFrame”) that ultimately…
A Rust-based remote access trojan (CikaBika Bot) was delivered using a document-themed lure that included a malicious Windows shortcut (LNK) and a PDF containing an embedded payload. Once installed, it used Discord as its command-and-control channel to run commands, collect information, and steal…
Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which…
