Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Siemens Software Center users: this robot check is a trap. The Romulus ClickFix lure says to paste its command into Win+R or PowerShell. That's the trick: you run the command for it. A real robot check stays in the browser. This one can place malicious DLLs beside a genuine, signed Siemens app and exploit CVE-2026-110936. If a website asks you to paste a command into Windows, don't paste it.
Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
This article describes ClickFix attacks in which fraudulent or compromised websites display fake technical warnings and persuade visitors to copy and run harmful commands. The scam may claim a browser update, failed security check, or urgent technical repair is needed, then directs the user to use…
Microsoft reported a campaign where attackers abused hotel Wi‑Fi captive portals to manipulate DNS/HTTP traffic and redirect people to attacker-controlled phishing pages. Victims were tricked into installing malware disguised as browser/operating system updates, and some pages redirected users into…
Microsoft reports a real-world campaign where attackers tamper with Wi‑Fi captive portal traffic at hotels and similar venues to redirect travelers to attacker-controlled pages. Victims are pushed into fake Microsoft sign-ins (device code/OAuth phishing) or tricked into installing “browser/OS…
Google is updating Chrome Enhanced Protection to warn people when scam websites try to trick them into copying and running harmful commands. These ClickFix scams use fake computer problems, such as bogus browser or antivirus alerts, to move victims from the browser into a terminal where security…
