Figure 3 Email Body Figure 4 Attachment A Deep Dive into OneNote File Format File Header An example email body and attachment is shown in Figure 3 and 4. These types of themes are more likely to be opened by the vicim. The generic theme of the e mail is i nvoice or legal related. We have observed that most of the malicious documents either have Windows batch script that invokes Powershell for dropping the malware on the system or Visual Basic scripts that does the same. The malicious document is delivered in either zip files or ISO images to the target through phishing emails. OneNote Campaigns in the wild Figure 1 Campaign Heatmapįigure 1 shows the geo wise distribution of McAfee customers detecting malicious OneNote files.īased on the telemetry from our endpoints we have identified the following threat families deployed through OneNote documents:Ī holistic view of the phishing campaigns that weaponize OneNote document is shown in Figure 2 below. This blog contains analysis on how OneNote documents are used malicious and two specific campaigns that made use of OneNote documents to download and execute the Qakbot malware. Due to a feature that allows users to attach files to OneNote documents it makes them a good alternative to LNK files as distribution vehicle to deploy their malware.

Such as their shift to LNK files after Microsoft introduced a policy change disabled office macros by default. Malicious Actors are always trying to find new ways in to infect their victims. It is installed by default in Microsoft Office 2021 and Microsoft 365.

It is a note-taking app that allows collaboration across organizations while enabling users to embed files and other artifacts. OneNote is a Microsoft digital notebook application that can be downloaded for free.

McAfee Labs has recently observed a new Malware campaign which use d malicious OneNote documents to entice users to click on an embedded file to download and execute the Qakbot trojan. Authored By Anandeshwar Unnikrishnan, Sakshi Jaiswal,Anuradha M

Onenote export notebook