CrowdStrike researchers have published the first documented analysis of Microsoft ClickOnce deployment technology being weaponized as a malware delivery channel, revealing that attackers can deliver malicious payloads to Windows systems without requiring administrative privileges. The no-admin requirement is significant: it means this vector bypasses one of the most common access controls organizations rely on to contain initial access operations, expanding the viable attack surface to virtually any Windows endpoint running .NET applications. This disclosure signals a broadening of living-off-the-land tradecraft into trusted developer tooling, a pattern that has historically outpaced detection coverage in enterprise environments.