Abusing ClickOnce

The report demonstrates how attackers can abuse Internet Explorer's ClickOnce deployment popups to trick users into installing malware by spoofing the application Name, truncating the From domain to appear legitimate, and using legitimate or stolen code-signing certificates for the Publisher field; the technique is easy to implement, effective for social engineering, and should be monitored though broad attacks have not been observed.