New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever
2026-06-20T07:23:32Z•f35bd0daa0fc9c551d1a77fa563b7eba450afd3e40d254bacb8c5af27a455ffc
ai-securitychinaclickonceclickonce-abusecontinuous-identitycrowdstrikeexposure-managementidentity-managementmicrosoft-zero-daypatch-tuesdaythreat-landscapevulnerabilities
What happened
CrowdStrike blog RSS (June 9–18, 2026) summarizing multiple posts: a two-part disclosure on new abuse of Microsoft ClickOnce application deployment (technique for persistence/abuse and mitigation guidance); the June 2026 Patch Tuesday analysis noting 206 Microsoft vulnerabilities including three publicly disclosed zero‑days; guidance and product announcements on securing AI after Executive Order 14409, Continuous Identity for AI agents, Falcon Exposure Management for third‑party environments, identity leadership (OpenID, IDPro), and the CrowdStrike 2026 Technology Threat Landscape Report (not‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- crowdstrike_blog
- Record identifier
- f35bd0daa0fc9c551d1a77fa563b7eba450afd3e40d254bacb8c5af27a455ffc
- Enrichment time
- 2026-06-20T07:23:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.