CrowdStrike researchers have documented a multi-technique attack campaign exploiting Microsoft’s ClickOnce deployment framework, a built-in Windows mechanism, to deliver malware, achieve fileless persistence, and update payloads without requiring administrator privileges. The attack chain executes entirely within trusted Microsoft process trees, allowing it to evade email filters and endpoint controls tuned to detect traditional executable formats. This research signals a broader adversarial shift toward abusing legitimate, low-scrutiny Windows components, meaning organizations cannot rely on perimeter or signature-based controls alone to detect or block this class of threat.