Skip to content
Threat Feed
Subscribe

Product

Microsoft ClickOnce

1 brief RSS
high advisory

New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

Threat actors are actively exploiting Microsoft's ClickOnce deployment technology, leveraging its low user interaction, lack of privilege requirements, and built-in update mechanisms to deliver malware, establish persistence, and maintain remote access, often executing payloads within legitimate rundll32.exe and dfsvc.exe processes.

PoC ClickOnce +11 microsoft persistence delivery windows endpoint
2r 7t 26i updated