Lack of Awareness and Security Measures: Exploits in Microsoft OneNote are not as well-known as macro-based attacks, which often leads to organizations not having sufficient security measures to prevent these types of attacks.Įvasion Techniques: Although the “Mark of the Web” is a Windows security feature that protects users from potentially harmful content downloaded from the internet, OneNote does not propagate this feature on its attachments. It is pre-installed in all Microsoft Office/365 installations, meaning that even if a Windows user does not use the application, the file format is still available for malicious OneNote documents to deceive a user into running them. OneNote’s Popularity and Wider Reach: OneNote’s popularity as a widely used note-taking application and its ability to embed different types of content make it a useful tool for attackers to distribute malware.

Furthermore, in July 2022, Microsoft disabled Macros by default on all Office applications, rendering this approach unreliable for malware distribution. As a result, it has become more challenging for attackers to deliver malware through these attacks. Increased Security Measures: Due to the growing awareness of macro-based attacks, many organizations have been implementing security measures to prevent such attacks.

Attackers use OneNote to deliver malicious payloads by obfuscating the content and exploiting the trusted application status of OneNote. OneNote has become an increasingly attractive vector for attackers due to its popularity, wider reach, lack of awareness and security measures, and ability to integrate with other Microsoft products. ThreatLabz detected various types of malware distributed through OneNote documents including Bankers, Stealers and RAT (Remote-Access-Trojan).Īttackers have shifted from using traditional macro-based attacks to using Microsoft OneNote as a delivery mechanism for malware. OneNote Document can run the following types of scripts CHM, HTA, JS, WSF, and VBS. The advantage of OneNote documents is that they can embed similar malicious code as macro/VBA office documents with less detection.Īlso MSHTA, WSCRIPT, and CSCRIPT can be executed from within OneNote and attackers can use multi-layer obfuscation with this script to bypass threat detection. Previously Threat actors target users with malicious macro enabled documents but, in July 2022, Microsoft disabled Macros by default on all Office applications, making this approach unreliable for distributing malware. OneNote is installed by default in all Microsoft Office/365 installations, even if a Windows user does not use the application, it is still available to open the file format because it is easy to deceive a user to run a malicious OneNote Document. Threat actors are increasingly using Microsoft OneNote documents to deliver malware via phishing emails.

Install onenote