🧰 ClickOnce

The items that name it 2

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeup2026-09-15

  Microsoft deployment feature abused by the threat actor to deploy the Windows malware application without a custom installer

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeup2026-08-19

  Windows deployment technology abused via signed GapiUpdate.application manifest to direct installation to an actor-controlled location