How Threat Actors Embed Files in OneNote Documents

Beginning in December 2022, Microsoft Office OneNote (.one) files have been used in malicious emails to deliver multiple malware families, including the well-known QakBot and Emotet. Threat actors have likely been experimenting with .one files as an alternative to Office macros, which are now becoming less common. Word and Excel documents with Office macros were […]

The post How Threat Actors Embed Files in OneNote Documents appeared first on Cofense.

cofense december documents emails emotet excel files macros malicious malware microsoft microsoft office office office macros onenote qakbot threat threat actors well-known word