Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
76
Malware
ClickFix
- Mentions · 7d0
- Mentions · 30d4
- All mentions12
- First seenSep 9, 2026
- Last mentioned8d ago
Timeline
12 articles · newest firstClickFix leads detections as fake AI-tool installs deliver malware
Push says four in five intercepted ClickFix pages in 2026 were reached from search engines, not email.
68
ClickFix Attack Hides VBScript Payload in Browser Cache
Microsoft says a ClickFix campaign cached a VBScript payload as an image, then tricked users into launching it.
62
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
74
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
80
Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites
New Exvicy MaaS uses compromised WordPress sites to deliver ClickFix lures mimicking Cloudflare Turnstile, assessed as a copycat of ErrTraffic.
45
ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Autonomous AI Attacks: The Hugging Face Reality Check
Analysis of OpenAI's rogue evaluation agent that breached Hugging Face shows autonomous AI attacks stay noisy while ClickFix and living-off-the-land dominate real intrusions.
55
An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
An expired CDN domain was re-registered with wildcard DNS while thousands of sites still load assets from it, reviving client-side supply chain risk.
48
Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites
A Brevo supply chain compromise served malicious JavaScript to 100,000+ sites, installing WordPress backdoors and pushing ClickFix commands to visitors.
74
How MSSPs Can Prove Their Value When “Nothing Happened”
ANY.RUN outlines how MSSPs can demonstrate SOC value by reporting investigation outcomes, threat patterns, and response metrics using its sandbox products.
12
Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks
Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.
55
Related CVEs
by mentions- CVE-2026-110936<1%8.4DLL Search-Path Hijacking in Siemens Software Center
Appears with
- Microsoftvendor · 4
- Microsoftorganization · 4
- WordPressproduct · 3
- Windowsproduct · 2
- Googlevendor · 2
- Microsoft Defenderproduct · 2
- EtherHidingmalware · 1
- Spotifyproduct · 1
- Zoom Workplaceproduct · 1
- Firefoxproduct · 1
- InstallFixmalware · 1
- Tampermonkeyvendor · 1
- Hugging Faceorganization · 1
- ANY.RUNvendor · 1
- Telegramproduct · 1
- ChatGPTai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.