Attackers are actively using fake human-verification prompts to persuade people to run commands through a legitimate, digitally signed Siemens application. The broader report also says SafePay ransomware operators gain access through phishing and stolen credentials, then target recovery data and threaten to leak stolen files.
In this scheme, attackers present users with a fake human-verification prompt, the kind of check-box or captcha-style interaction many people now expect on legitimate websites and applications. Instead of confirming a person is human, the prompt convinces the user to run commands through a legitimate, digitally signed Siemens program. Because the application itself is trusted and signed, the activity can look routine to both the user and some security tools.
This approach relies on the T1204.004 technique, user execution through a form of malicious copy paste, where the victim is guided into pasting or running commands they believe are harmless verification steps.
The core reason this technique works is trust. The Siemens technique abuses trust in a recognized application rather than relying on an obviously malicious unsigned tool. Users and even some security controls are conditioned to treat signed, well-known software as safe, so a prompt that appears to come from or interact with that software can bypass normal suspicion. This is compounded by how common verification prompts have become across everyday browsing and software use, making people less likely to question one more request to click or run something.
Security teams and employees should watch for:
Organizations can reduce the risk from this type of attack by combining user awareness with technical controls. Employees across manufacturing, engineering, IT, help desk, and security operations roles should be trained to pause and verify unexpected prompts through an approved IT or security contact rather than acting on them immediately, even when a trusted application is involved.
On the technical side, defenders should:
Together, these steps address both the social engineering entry point and the follow-on ransomware risk described in the broader report.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers present a fake human-verification prompt that convinces users to run commands through a legitimate, digitally signed Siemens application, abusing trust in a recognized tool rather than using obviously malicious software.
Because it relies on a trusted, signed Siemens program instead of an unsigned or clearly malicious file, which makes the activity look more legitimate to users and some security tools.
The broader report notes that SafePay ransomware operators separately gain access through phishing, stolen credentials, and unpatched internet-facing systems, then destroy recovery data and threaten to leak stolen files.
They should pause and avoid running any commands, and verify the prompt through an approved IT or security contact before taking action.
A human-verification check asks you to run a command? Stop. This fake check tells you to run a command through Siemens Software Center. The app is real and digitally signed. That's the trick: a trusted app can still be misused. Siemens Software Center shouldn't need instructions from a random webpage. And a signed app running from an unusual location is a red flag, not proof it's safe. If a verification prompt wants a command, don't run it. Send the prompt to your approved IT contact.
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
A Rust-based remote access trojan (CikaBika Bot) was delivered using a document-themed lure that included a malicious Windows shortcut (LNK) and a PDF containing an embedded payload. Once installed, it used Discord as its command-and-control channel to run commands, collect information, and steal…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
