OneNote Malware Spread in Attachments
Microsoft OneNote malware is a type of malicious software that is distributed using trojanized OneNote (.one) files. These documents have been modified to contain virulent content, which triggers the download and installation process when interacted with. This form of malware distribution has become more popular due to Microsoft's decision to block macros from the Internet on MS Office documents.
Malicious OneNote files are usually spread through spam campaigns, either as attachments or via download links. Two known types of malware that have been observed being proliferated in this manner are the Qakbot banking trojan and RedLine Stealer. The former targets finance-related information and can cause chain infections, while the latter is designed to extract sensitive data from infected devices.
The emails used in these campaigns tend to be impersonal, with only the recipient's last name written in the subject line for some messages. The malicious OneNote files contain an HTML application (HTA file) embedded into them, which downloads/installs the malware when clicked. However, any type of file can be embedded into OneNote documents.
Infection chains require additional user interaction before they can begin – for example, enabling macro commands on Office documents or clicking embedded content on OneNote files. Cyber criminals often resort to social engineering tactics to achieve this, such as fake buttons like "Open" or "Double Click To View File".
What is OneNote, the legitimate Microsoft software that the hackers attempt to abuse?
Microsoft OneNote is a note-taking application that allows users to create and store notes, drawings, audio recordings, and other content. It is part of the Microsoft Office suite of applications and can be used on Windows, MacOS, iOS, Android, and web browsers. It also supports collaboration between multiple users.
Why are attachments of any kind a potential security threat?
Attachments of any kind can be a potential security threat because they can contain malicious code or malware that can infect a computer system when opened. Malware can be used to steal data, disrupt operations, and even take control of the system. Attachments may also contain viruses, which are programs designed to spread from one computer to another and cause damage. Additionally, attachments may contain phishing links or other malicious content that could lead to further security risks.
