ClickonceHunter

ClickonceHunter Tool released in combination with the Less SmartScreen More Caffeine: ClickOnce AbUse for Trusted Code Execution conference presentation / blog post by 0xthirteen and myself. Golang web scraper that makes use of both chromedp, as well as normal HTTP requests to scrape search engin...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

April 14, 2026-KB5082413 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019

April 14, 2026-KB5082413 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019 Applies To .NET Note Release Date: April 14, 2026 Version: .NET Framework 3.5 and 4.7.2 The April 14, 2026 update for Windows 10, version 1809 and Windows Server 2019...

April 14, 2026-KB5082425 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 2022

April 14, 2026-KB5082425 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 2022 Applies To .NET Note Release Date: April 14, 2026 Version: .NET Framework 3.5 and 4.8.1 The April 14, 2026 update for Windows Server 2022 includes security and cumulative reliability improvements i...

April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2

April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2 Applies To .NET Note Revised April 22, 2026: Revised on April 22nd, 2026 to add the known issue section. Note Release Date: April 14, 2026 Version: .NET Framework 3....

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...

SideWinder's Shifting Sands: Click Once for Espionage

SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...

SideWinder's Shifting Sands: Click Once for Espionage

SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...

EUVD-2024-26504

Malicious code in bioql PyPI...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...

OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors

Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...

OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors

Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · June 24, 2025 The Trellix Advanced Research Center has uncovered a sophisticated APT malware campaign that we’ve dubbed OneClik. It specifically targets the energy, oil...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

September 8, 2020-KB4576480 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1703

September 8, 2020-KB4576480 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1703 Applies To .NET Note Release Date: September 8, 2020 Version: .NET Framework 4.8 Summary Security improvements ClickOnce will no longer download applications from untrusted servers which use NTLM...

July 13, 2021-KB5003536 Cumulative Update for .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2

July 13, 2021-KB5003536 Cumulative Update for .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2 Applies To .NET Release Date: July 13, 2021 Version: .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2 The July 13, 2021 update for Microsoft...

September 8, 2020-KB4576627 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 and Windows Server 2019

September 8, 2020-KB4576627 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 and Windows Server 2019 Applies To .NET Note Release Date: September 8, 2020 Version: .NET Framework 3.5, 4.7.2 and 4.8 Note This update is included in the Cumulative Update that's date...

September 8, 2020-KB4576484 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 1903, Windows Server 1903 RTM, Windows 10, version 1909 and Windows Server, version 1909

September 8, 2020-KB4576484 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 1903, Windows Server 1903 RTM, Windows 10, version 1909 and Windows Server, version 1909 Applies To .NET Note Release Date: September 8, 2020 Version: .NET Framework 3.5 and 4.8 Summary ClickOnce...