Threat actors are always looking for ways to get malware into your system, and it often seems like they have a limitless pool of ingenuity to fall back on. This time they’ve been caught trying to spread malware via Microsoft OneNote attachments in phishing emails — specifically remote access malware.
It’s been long known that attackers have used Microsoft Office files to spread malware for many years, particularly Word and Excel attachments. Microsoft finally took some action last July, disabling Office documents’ macros by default and making it an unreliable way to infect unsuspecting recipients.
Apparently this is down to OneNote features that allows users to add attachments to a notebook. The attached OneNote file appears to be blurred out, with a large button that says “Double Click to View File." But double clicking this button runs the file’s attachment, which is a malicious Visual Basic Script (VBS) file. That VBS is then able to download malware from a remote site and install it on your machine.
The best way to stay safe from these kinds of attacks is to not open files from anyone you don’t actually know — especially OneNote files. On top of that, if you ever do open an unknown file, you need to listen to all the warnings that may pop up, all for your own safety.
