frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

ClickonceHunter

ClickonceHunter 该工具与 Less SmartScreen More Caffeine: ClickOnce AbUse for Trusted Code Execution 会议演讲 / 博客文章 一同发布，作者为 0xthirteen 和我本人。 这是一个 Golang Web 爬虫，同时使用 chromedp 以及普通 HTTP 请求来抓取搜索引擎上已发布的 ClickOnce 应用程序。支持 AWS API Gateway 源 IP 轮换，并可指定 HTTP 代理用于故障排查。目前支持抓取 Google 和 Swisscows 搜索引擎。 致谢 Mike Felc...

April 14, 2026-KB5082425 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 2022

None None...

April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2

None None...

April 14, 2026-KB5082413 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019

None None...

February 10, 2026-KB5074837 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1

None None...

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...

SideWinder's Shifting Sands: Click Once for Espionage

SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...

EUVD-2024-26504

Malicious code in bioql PyPI...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...

OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors

Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · June 24, 2025 The Trellix Advanced Research Center has uncovered a sophisticated APT malware campaign that we’ve dubbed OneClik. It specifically targets the energy, oil...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-29500

The Secure Lockdown Multi Application Edition (version v2.00.219 ) by Inteset Systems contains a vulnerability in its kiosk mode . This flaw allows an attacker to execute arbitrary code by running a ClickOnce application instance , categorized as CWE-94 (Improper Control of Generation of Code). N...

CVE-2024-29500: Improper Control of Generation of Code

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

PT-2024-22927 · Unknown · Secure Lockdown Multi Application Edition

Name of the Vulnerable Software and Affected Versions: Secure Lockdown Multi Application Edition version 2.00.219 Description: An issue in the kiosk mode of Secure Lockdown Multi Application Edition allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...