New Abuse of ClickOnce Technology: Stop Threat Actors from Clicking Once and Staying Forever

CrowdStrike has observed a new abuse of Microsoft's ClickOnce technology by threat actors to facilitate initial access, execute malicious payloads, and establish persistence on target systems. Beginning as early as June 2026, this technique exploits the inherent user-friendliness and low-privilege requirements of ClickOnce application deployment, often bypassing traditional security controls like email filtering. Threat actors deliver malicious .application files, leveraging user unfamiliarity with ClickOnce installations to trick victims into executing malware. Once deployed, these applications run within legitimate Microsoft processes such as rundll32.exe and dfsvc.exe, enhancing stealth. Persistence is achieved by placing .appref-ms files in the Windows Startup folder or registering them as scheduled tasks, ensuring malware re-execution. The built-in update mechanism of ClickOnce further allows attackers to update their malware, change command and control (C2) infrastructure, or facilitate lateral movement, creating a highly potent and stealthy attack vector for remote access and data exfiltration.

Attack Chain

1. Initial Access: Threat actors send phishing emails containing links or direct users to malicious websites that prompt them to "click a button" for a supposed application or document.
2. Delivery: The user clicks the link, triggering the download and execution of a malicious .application file (a ClickOnce deployment manifest).
3. Execution: The ClickOnce runtime components, specifically dfsvc.exe (Deployment Services) and rundll32.exe, legitimately process the .application file and execute the embedded malicious payload without requiring administrator privileges.
4. Payload Deployment: The malicious ClickOnce application installs its payload (e.g., a backdoor, infostealer, or remote access tool) onto the system, often in user-writable ClickOnce application cache directories like %LOCALAPPDATA%\Apps\2.0\.
5. Persistence via Startup Folder: To maintain access, the attacker places the malicious application's .appref-ms shortcut file directly into the user's Windows Startup folder (%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup).
6. Persistence via Scheduled Task: Alternatively, the attacker creates a Scheduled Task to regularly execute the malicious ClickOnce application by referencing its .appref-ms file, ensuring repeated execution upon system events or specific intervals.
7. Command and Control / Updates: The malicious ClickOnce application uses its built-in update mechanism to communicate with a threat actor-controlled server, fetching new components, receiving updated instructions, or changing C2 infrastructure for continued remote access.
8. Impact: The attacker achieves persistent remote access, enabling further actions such as data exfiltration, lateral movement, or the deployment of additional malware like ransomware.

Impact

This ClickOnce abuse creates a significant impact by bypassing common enterprise security mechanisms due to its reliance on legitimate Microsoft technology and minimal user interaction. Organizations targeted may experience unauthorized access, data exfiltration, and persistent footholds for threat actors without requiring elevated privileges. The stealthy execution within trusted Microsoft processes makes detection challenging, leading to prolonged compromise and potentially significant financial and reputational damage. The lack of user awareness regarding ClickOnce installations also makes users highly susceptible to social engineering, contributing to a high success rate for initial access.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious ClickOnce activity.
• Configure endpoint detection and response (EDR) solutions to monitor dfsvc.exe for unusual child process creation, especially scripting engines, as covered by "Detect ClickOnce Deployment Service (dfsvc.exe) Spawning Scripting/Shell Processes".
• Enhance file integrity monitoring and process creation logging to detect the creation of .appref-ms files in user Startup folders, specifically addressing the behavior described in "Detect ClickOnce Persistence via Startup Folder".
• Educate users about the risks associated with installing software from untrusted sources, even if it appears to be a "one-click" installation, emphasizing the dangers of .application files.
• Implement application whitelisting or strict software restriction policies to prevent the execution of applications from user-writable directories like AppData where ClickOnce applications are commonly installed.