{"id":166243,"date":"2023-03-30T16:37:03","date_gmt":"2023-03-30T23:37:03","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=166243"},"modified":"2023-07-11T11:17:08","modified_gmt":"2023-07-11T18:17:08","slug":"rising-trend-of-onenote-documents-for-malware-delivery","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rising-trend-of-onenote-documents-for-malware-delivery\/","title":{"rendered":"The Rising Trend of OneNote Documents for Malware delivery"},"content":{"rendered":"

Authored By<\/span><\/span> Anandeshwar<\/span> Unnikrishnan<\/span>,<\/span>Sakshi<\/span> Jaiswal,Anuradha<\/span> M<\/span><\/span>\u00a0<\/span><\/em><\/p>\n

McAfee Labs has recently <\/span>observed<\/span> a new <\/span>Malware <\/span>campaign which use<\/span>d<\/span> malicious OneNote documents to <\/span>entice<\/span> users to click on an embedded file to download and execute the <\/span>Qakbot<\/span> trojan.<\/span><\/span>\u00a0<\/span><\/p>\n

OneNote<\/span><\/a> is a Microsoft digital notebook application that can be downloaded for free. It is a note-taking app that allows collaboration across organizations while enabling users to embed files and other artifacts. It is installed by default in Microsoft Office 2021 and Microsoft 365.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Malicious Actors are always trying to find new ways in to infect their victims. Such as their shift to <\/span>LNK files<\/span><\/a> after Microsoft introduced a policy change <\/span>disabled office macros by default<\/span><\/a>. Due to a feature that allows users to attach files to OneNote documents it makes them a good alternative to LNK files as distribution vehicle to deploy their malware. This blog contains analysis on how OneNote documents are used malicious and two specific campaigns that made use of OneNote documents to download and execute the Qakbot malware.\u00a0<\/span>\u00a0<\/span><\/p>\n

OneNote Campaigns in the wild<\/span><\/span>\u00a0<\/span><\/strong><\/h2>\n
\"Figure
Figure 1 Campaign Heatmap<\/figcaption><\/figure>\n

Figure 1\u00a0<\/span> shows the geo wise distribution of McAfee customers detecting malicious OneNote files.<\/span>\u00a0<\/span><\/p>\n

\u00a0Based on the telemetry from our endpoints we have identified the following threat families deployed through OneNote documents:<\/span>\u00a0<\/span><\/p>\n