Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“I am not a robot.” So why is this page asking you to press Win+R? That’s ClickFix: a fake verification tells you to paste a command into Windows Run or PowerShell. The Romulus campaign uses it to deliver a PowerShell script and a Siemens-looking installer. Here’s the catch: the Siemens Software Center program really is signed. Malicious files placed beside it exploit a DLL side-loading flaw; one payload can read information stored in Chrome. A real human check never needs Windows Run. Don’t paste a website’s command into Win+R or PowerShell.
Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.
Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.
Attackers abused a trusted, signed Siemens Software Center program to run malicious code and install a remote access trojan. Victims were directed to a fake web address containing a ClickFix lure, where copying and running the displayed content launched PowerShell and an installer that exploited…
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
