Home Today’s Briefing Deep Dives In Play Trending For You Discover My Stack Saved Off Radar Search

Loading today’s stories

Today

AI-assisted reporting, grounded in a per-article claim ledger. Perspective Coverage and Reality Strip separate source viewpoints from evidence, adoption, hype, incentives, and confidence.

Today

Front Page
Today’s Briefing
Newsletters
Trending
For You
Discover
My Stack
Saved
Off Radar
Search

Sections

Security
Build
Invest
Product
Leadership
Science

Company

About
Mission
How this is made
Evidence Index
The desks
The sources we read
Corrections
Press and brand
The daily edition

Trending now

ClickFix-Style Social Engineering
Infostealer Malware
Agentic Security Operations
Enterprise CRM Automation
Custom AI Accelerators
Public Opinion on AI
AI Agent Governance
AI Data Center Siting
Inference cost economics
Map Platform Compliance

How this is made

Today For You My Stack Off Radar Search

other

Microsoft .NET ClickOnce Launch Utility

Legitimate Microsoft binary renamed to 'NET Runtime Optimization Service.exe' and used to sideload a malicious mscoree.dll in two of the three chains.

Known aliases

dfsvc.exe
NET Runtime Optimization Service.exe

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 distinct publisher

ClickFix lures now paste an msiexec command that installs legitimate software to sideload a DLL

Field Effect logged three ClickFix chains between mid-June and July 2026, two of them landing on the same hidden file pair in ProgramData, and in one case the operator phoned the victim to open the lure.

Publishers:fieldeffect.com

Reality

Evidence60
Adoption34
Hype gap−8
Incentives58

Confidence55

Microsoft .NET ClickOnce Launch Utility — other — Clarity Today