Windows 365 Client Execution

Duo Tech@duotech

•updated Jun 8, 2026•0•0•6

Monitors for the execution of Windows 365 native clients (Windows365.exe). Threat actors, such as UNC3753, abuse legitimate Virtual Desktop Infrastructure (VDI) clients on compromised personal Bring Your Own Device (BYOD) endpoints to bypass initial corporate perimeters and access sensitive network segments.