Microsoft OneNote is still being used to flood devices with malware

Microsoft’s OneNote, a note-taking app that’s part of the Office 365 productivity suite, is drawing increasingly more attention to itself, for all the wrong reasons. 

This follows another report from cybersecurity researchers describing how more and more threat actors are beginning to use the application to deliver malware to unsuspecting victims.

This time, researchers from Zscaler published a report (opens in new tab) describing OneNote as a “growing threat” for malware distribution.

Fake invoices and orders

The delivery method is similar to that of macro-powered Office files. The attackers would generate a OneNote file, called a NoteBook, designing it to look like an important document such as an invoice or something similar. Inside the file, they would place a malicious attachment capable of downloading and running a piece of malware from a third-party server. Then, they’d blur the file’s contents and overlap it with a button saying “Click here to view”, or a similar call to action. 

Clicking the button would activate the add-on and run the malware.

The file would then be distributed the usual way – via email. Hundreds of thousands of phishing emails are being sent daily, targeting corporate endpoints, personal computers, and other devices holding sensitive customer and personal data.

Last summer, Microsoft finally disabled Office programs from running macros in files downloaded from the internet. That way, the company effectively terminated one of the most popular attack vectors among the cybercriminal community. Since then, hackers were hard at work, looking for alternative ways to deliver malware. Two methods began standing out – delivering an ISO file (a type of archive file that enables hackers to bypass email and antivirus security), and delivering NoteBook files.

To protect against these types of attacks, cybersecurity researchers usually advise common sense – not to download email attachments, or click on links in emails whose contents, sender address, or subject line, sound even remotely suspicious.