Emotet Being Distributed via OneNote

AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of Emotet being distributed via OneNote. A spear phishing email as below attached with a OneNote file prompts the reader to open the attachment which contains a malicious script file (JS file).

Figure 1. Phishing email attached with a malicious OneNote file

Upon running the OneNote file, it directs the user to click the button to connect to the cloud to open the document. This ‘Next’ button is inserted …

ahnlab asec attachment center cloud connect distributed distribution document email emergency emotet file malicious malware analysis onenote phishing prompts reader response script security spear phishing