Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A CAPTCHA wants you to open Run? That's not a CAPTCHA. Romulus ClickFix pages say, 'Complete the CAPTCHA check by pasting and executing the verification command.' That command can bring malware onto your device. Here's the twist: the malware can use a genuinely signed Siemens Software Center program to load malicious DLLs beside it. The signature doesn't make the bundle safe. If a website asks you to run a command, close the page and report it to security.
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.
Attackers used sponsored Google search ads to lure people to a malicious ChatGPT Custom GPT (“Plus 5.6”) hosted on the real chatgpt.com site. The Custom GPT redirected victims to a fake Cloudflare CAPTCHA page that instructed them to copy/paste a command into a terminal, leading to installation of…
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
Researchers observed threat actors creating attacker-made ChatGPT Custom GPTs that look legitimate, then steering users to a Google Sites “backup domain.” Victims are shown a fake Cloudflare CAPTCHA that tricks them into copying and running a malicious PowerShell command, which downloads and runs…
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
