Microsoft OneNote is still being used to flood devices with malware

NordVPN schützt dich mitunter vor gemeinen, schädlichen Phishing-Attacken beim Surfen im Netz

(Image credit: Nord Security)

Microsoft’s OneNote, a note-taking app that’s part of the Office 365 productivity suite, is drawing increasingly more attention to itself, for all the wrong reasons.

This follows another report from cybersecurity researchers describing how more and more threat actors are beginning to use the application to deliver malware to unsuspecting victims.

This time, researchers from Zscaler published a report describing OneNote as a “growing threat” for malware distribution.

Fake invoices and orders

The delivery method is similar to that of macro-powered Office files. The attackers would generate a OneNote file, called a NoteBook, designing it to look like an important document such as an invoice or something similar. Inside the file, they would place a malicious attachment capable of downloading and running a piece of malware from a third-party server. Then, they’d blur the file's contents and overlap it with a button saying “Click here to view”, or a similar call to action.

> These are the best firewalls around

> Malicious use of Microsoft OneNote documents on the rise

> Microsoft OneNote attachments are being used to spread malware

Clicking the button would activate the add-on and run the malware.

The file would then be distributed the usual way - via email. Hundreds of thousands of phishing emails are being sent daily, targeting corporate endpoints, personal computers, and other devices holding sensitive customer and personal data.

Last summer, Microsoft finally disabled Office programs from running macros in files downloaded from the internet. That way, the company effectively terminated one of the most popular attack vectors among the cybercriminal community. Since then, hackers were hard at work, looking for alternative ways to deliver malware. Two methods began standing out - delivering an ISO file (a type of archive file that enables hackers to bypass email and antivirus security), and delivering NoteBook files.

To protect against these types of attacks, cybersecurity researchers usually advise common sense - not to download email attachments, or click on links in emails whose contents, sender address, or subject line, sound even remotely suspicious.

Check out the best endpoint protection tools today

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.