CrowdStrike researchers have documented a campaign abusing Microsoft’s ClickOnce application deployment framework to establish persistence and deliver malicious payloads on Windows endpoints without requiring administrator privileges. Any enterprise endpoint running standard user accounts is in scope, making this a broad, stealthy threat that bypasses traditional executable-focused detection controls by leveraging trusted, Microsoft-signed infrastructure. The primary business risk is undetected persistence across the enterprise estate, enabling follow-on data theft, ransomware staging, or lateral movement with minimal forensic footprint.