Researchers at CrowdStrike have documented active abuse of Microsoft’s ClickOnce deployment framework, a legitimate Windows technology, to achieve persistent footholds on endpoints without requiring administrator privileges. Attackers deliver malicious .appref-ms files, commonly via email, then leverage Windows-native processes (dfsvc.exe, rundll32.exe) to install payloads and maintain silent, self-updating persistence that bypasses many standard email and endpoint controls. Any organization running standard Windows endpoints is exposed; the attack requires no elevated rights and exploits trusted Microsoft infrastructure, making detection and containment non-trivial because the technique relies entirely on legitimate Microsoft processes and infrastructure.