Threat actors are using malicious attachments in OneNote in order to distribute malware, BleepingComputer reports. The attackers attach VBS files that instruct the user to double-click on the file. Most of the phishing lures pose as shipping notifications, invoices, or mechanical drawings.
“OneNote allows users to insert attachments into a NoteBook that, when double-clicked, will launch the attachment,” BleepingComputer says. “Threat actors are abusing this feature by attaching malicious VBS attachments that automatically launch the script when double-clicked to download malware from a remote site and install it. However, the attachments look like a file's icon in OneNote, so the threat actors overlay a big 'Double click to view file' bar over the inserted VBS attachments to hide them.”
In this case, the attackers are delivering the AsyncRAT, Quasar, and XWorm remote access Trojans.
“Once installed, this type of malware allows threat actors to remotely access a victim’s device to steal files, saved browser passwords, take screenshots, and in some cases, even record video using webcams,” BleepingComputer says. “Threat actors also commonly use remote access trojans to steal cryptocurrency wallets from victims' devices, making this a costly infection.”
BleepingComputer offers the following advice to help users avoid falling for these types of attacks.
“The best way to protect yourself from malicious attachments is to simply not open files from people you do not know,” BleepingComputer says. “However, if you mistakenly open a file, do not disregard warnings displayed by the operating system or application. If you see a warning that opening an attachment or link could harm your computer or files, simply do not press OK and close the application. If you feel it may be a legitimate email, share it with a security or Windows admin to help you verify if the file is safe.”
New-school security awareness training can enable your employees to recognize evolving social engineering attacks.
BleepingComputer has the story.
Here's how it works:
