Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware

[silversurfer]

Content source

https://thehackernews.com/2023/02/post-macro-world-sees-rise-in-microsoft.html

In a continuing sign that threat actors are adapting well to a post-macro world, it has emerged that the use of Microsoft OneNote documents to deliver malware via phishing attacks is on the rise.

Enterprise security firm Proofpoint said it detected over 50 campaigns leveraging OneNote attachments in the month of January 2023 alone.

In some instances, the email phishing lures contain a OneNote file, which, in turn, embeds an HTA file that invokes a PowerShell script to retrieve a malicious binary from a remote server.

Other scenarios entail the execution of a rogue VBScript that's embedded within the OneNote document and concealed behind an image that appears as a seemingly harmless button. The VBScript, for its part, is designed to drop a PowerShell script to run DOUBLEBACK.

"It is important to note, an attack is only successful if the recipient engages with the attachment, specifically by clicking on the embedded file and ignoring the warning message displayed by OneNote," Proofpoint said.

Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware

Watch out! Microsoft OneNote documents are the latest weapon of choice for cybercriminals to spread malware.

thehackernews.com

 

[Gandalf_The_Grey]

Microsoft OneNote to get enhanced security after recent malware abuse

Microsoft will introduce improved protection against phishing attacks pushing malware via malicious Microsoft OneNote files.

In a new Microsoft 365 roadmap entry published today titled "Microsoft OneNote : improved protection against known high risk phishing file types," the company revealed that this change would likely reach general availability sometime before the end of April 2023.

"We add enhanced protection when users open or download an embedded file in OneNote," Redmond explained.

"Users will receive a notification when the files deem dangerous to improve the file protection experience in OneNote on Windows."

This comes after a recent wave of phishing attacks where threat actors used maliciously crafted OneNote documents with '.one' file extensions and embedded files hidden behind overlays asking the targets to click to view the document.

Double-clicking launches the embedded file, which might seem innocuous but can have severe consequences.

Sadly, even when receiving security warnings, users often ignore them and allow the file to run, potentially putting their entire corporate network at risk.

Microsoft OneNote to get enhanced security after recent malware abuse

Microsoft is working on introducing improved protection against phishing attacks pushing malware via malicious Microsoft OneNote files.

www.bleepingcomputer.com