CrowdStrike researchers have documented new abuse techniques targeting Microsoft’s ClickOnce deployment framework, including a privilege-escalation-free persistence method that is newly documented. Any Windows enterprise environment using ClickOnce is exposed; threat actors can deliver malicious payloads via .application or .appref-ms files that commonly bypass email security gateways. The business risk is unauthorized persistent access to enterprise endpoints without triggering standard executable-based controls.