The team at INS Consulting would like to call attention to a new type of malware reported in the digital world.
The malware is hidden in a OneNote file, which is attached to an email. The threat actors use a fake button in the OneNote file that mimics a download of the document, but if clicked, it runs the embedded HTA attachment instead.
The email will most likely get through email filtering, as it’s a OneNote file, in the same way that an email would get through with a PDF attachment. The attack can only be successful if the recipient engages with the attachment. Therefore, we advise you to be cautious when receiving any OneNote files from unknown sources and refrain from opening or downloading any files/links from untrusted sources.
We have multiple security layers in place, such as email filtering and endpoint scanning, to help protect against these types of attacks. With your and your colleagues’ help, we can significantly reduce the likelihood of a successful attack. If you click on such a link or a file, don’t hesitate to contact us so we can review and confirm everything is ok.
Please contact our support staff if you have further questions regarding preventing cyber-attacks or if you’d like to know more about Phishing Simulations and how they can help. Read more here. The safety and security of your business are essential to you and us!
The INS Consulting team.
Sources:
OneNote Documents Increasingly Used to Deliver Malware | Proofpoint US
New QakNote attacks push QBot malware via Microsoft OneNote files (bleepingcomputer.com)
Qakbot mechanizes distribution of malicious OneNote notebooks – Sophos News.
