Stories from the SOC: OneNote MalSpam – Detection & response

This blog was co-written with Kristen Perreault – Professional Cybersecurity andJames Rodriguez – Sr. Specialist Cybersecurity.

Executive summary

Since December 22nd, 2022, there has been an increase in malware sent via Phishing emails via a OneNote attachment. As with most phishing emails, the end user would open the OneNote attachment but unlike Microsoft Word or Microsoft Excel, OneNote does not support macros. This is how threat actors previously launched scripts to install malware.

Minimal documentation has been made towards the …

attachment blog cybersecurity december detection detection & response emails end end user executive malspam malware onenote phishing phishing emails response rodriguez soc stories written