CrowdStrike researchers have documented how threat actors are weaponizing Microsoft’s ClickOnce deployment framework, a legitimate Windows and .NET feature designed for low-friction application installs, to deliver malware without requiring administrative privileges or triggering standard email attachment filters. Because ClickOnce uses trusted Windows infrastructure and operates through normal application update channels, it bypasses many organizations’ existing perimeter and endpoint controls with minimal user interaction. This campaign signals a broader attacker shift toward abusing by-design platform functionality, where no patch exists and detection requires deliberate tuning rather than vendor remediation.