Siemens software, used by Nvidia and Amazon, under active exploitation: Is your PC safe?

A Siemens application you'd normally trust is now being hijacked to deliver malware to Windows devices. Attackers are actively exploiting a vulnerability that may endanger millions of users.

The threat actors are abusing a vulnerability in Siemens Software Center to load malicious code through a legitimate, digitally signed application. Siemens says exploitation is active and is urging users to update.

Siemens Software Center is a desktop application used by millions of customers to download, update, and manage licenses of Siemens software.

Siemens corporate and industrial software is used across the global technology and engineering industries, serving more than 170,000 corporate customers in 38 countries.Siemens engineering tools are used by companies such as Apple, Amazon, Nvidia, Microsoft, Samsung, and Google, while its online community brings together more than 3.5 million registered members.

Such a broad customer base increases the potential scale and impact of the attack, especially for corporate workers.

The anatomy of an attack

The malicious campaign uses a technique known as DLL side-loading, taking advantage of the fact that Windows applications can load external code without necessarily checking whether it is trustworthy. The attackers distributed the software outside of official Siemens channels.

“The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. They chose this program as a carrier because it is signed and trusted,” Siemens said.

It was made possible by exploiting the CVE-2026-110936 vulnerability. The vulnerable Siemens software version (3.5.8.7) loaded helper files from its own directory without properly checking them. The malware then established persistence and network activity on the PC.

Siemens said it is not aware of a breach affecting its systems, products, or software update channels.

Social engineering is still a weak spot

The attack has been attributed to the Romulus multi-platform ClickFix campaign. ClickFix is a social engineering technique that tricks people into executing malicious commands on their own computers.

Attackers often disguise instructions as troubleshooting steps, error messages, or verification checks that appear to be legitimate security procedures.

A malicious prompt might tell a user to copy a command, open the Windows Run dialog or PowerShell, and paste it to prove they are human or to fix a supposed problem. However, once the user falls for the trick, the pasted code installs malware.

While Siemens gives no more details about the infection chain, it is likely that users were lured into running the malicious package or launching the bundled Siemens executable after falling for a social engineering attack.

How to stay safe?

To stay safe, you should always ensure you’re downloading software from official sites.

Also, never paste commands from a website into the Windows Run box or PowerShell just because a page claims it needs to verify that you’re human. Legitimate CAPTCHA checks do not require you to execute system commands.

The company fixed the vulnerability in version 4.0.9.8. Existing installations should update automatically the next time the application starts.

However, systems that have already been compromised may require additional attention from cybersecurity teams.

How to know if your Windows device was infected?

• An unexpected Siemens Software Center entry in startup applications or Task Scheduler on a computer where the software was never installed.
• A folder named SM Software Provisioning Service inside AppData\Local\Programs.
• Files named activate.bak or statinfosta.DB located alongside SiemensSoftwareCenter.exe.
• A folder named FTSuite containing a file called ftc.uml inside AppData\Local.
• Network connections to 96.62.218[.]59.
• Security teams should also investigate instances of SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec.
• Defenders are advised to block the following indicators of compromise: 96.62.218[.]59, wizardexpensive[.]com, 2.27.248[.]127