OneNote Attachments Used as Phish Hooks

Phishing Attacks Reach All-Time HighThreat actors are using malicious attachments in OneNote in order to distribute malware, BleepingComputer reports. The attackers attach VBS files that instruct the user to double-click on the file. Most of the phishing lures pose as shipping notifications, invoices, or mechanical drawings.

“OneNote allows users to insert attachments into a NoteBook that, when double-clicked, will launch the attachment,” BleepingComputer says. “Threat actors are abusing this feature by attaching malicious VBS attachments that automatically launch the script when double-clicked to download malware from a remote site and install it. However, the attachments look like a file's icon in OneNote, so the threat actors overlay a big 'Double click to view file' bar over the inserted VBS attachments to hide them.”

In this case, the attackers are delivering the AsyncRAT, Quasar, and XWorm remote access Trojans.

“Once installed, this type of malware allows threat actors to remotely access a victim’s device to steal files, saved browser passwords, take screenshots, and in some cases, even record video using webcams,” BleepingComputer says. “Threat actors also commonly use remote access trojans to steal cryptocurrency wallets from victims' devices, making this a costly infection.”

BleepingComputer offers the following advice to help users avoid falling for these types of attacks.

“The best way to protect yourself from malicious attachments is to simply not open files from people you do not know,” BleepingComputer says. “However, if you mistakenly open a file, do not disregard warnings displayed by the operating system or application. If you see a warning that opening an attachment or link could harm your computer or files, simply do not press OK and close the application. If you feel it may be a legitimate email, share it with a security or Windows admin to help you verify if the file is safe.”

New-school security awareness training can enable your employees to recognize evolving social engineering attacks.

BleepingComputer has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Free Phishing Security Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews