{"id":86873,"date":"2023-02-03T17:42:19","date_gmt":"2023-02-03T17:42:19","guid":{"rendered":"https:\/\/www.techrepublic.com\/?p=4030950"},"modified":"2023-02-15T10:36:49","modified_gmt":"2023-02-15T10:36:49","slug":"onenote-documents-spread-malware-in-several-countries","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=86873","title":{"rendered":"OneNote documents spread malware in several countries"},"content":{"rendered":"
\n

A new phishing campaign abuses OneNote documents to infect computers with the infamous AsyncRAT malware, targeting users in the U.K., Canada and the U.S.<\/p>\n<\/div>\n

\n
\"A
Image: Sashkin\/Adobe Stock<\/figcaption><\/figure>\n

As Microsoft decided to change<\/a> the default of its Office products to block macros on files downloaded from the internet, cybercriminals saw one of their favorite infection methods vanish.<\/p>\n

Some cybercriminals have already found a workaround to keep using some Microsoft Office products, like abusing the XLL files from Excel<\/a>. Some other cybercriminals have found a different way to keep abusing Microsoft products for infecting computers with malware: infected OneNote<\/a> documents.<\/p>\n

SEE: <\/strong>Mobile device security policy<\/strong><\/a> (TechRepublic Premium)<\/strong><\/p>\n

Phishing attacks deliver AsyncRAT malware<\/h2>\n

A new Bitdefender study<\/a> exposes a phishing campaign abusing OneNote to infect computers with malware. In that attack campaign, cybercriminals impersonated Ultramar, a Canadian gas and home fuel retailer, sending phishing emails supposedly coming from the company (Figure A<\/strong>).<\/p>\n

Figure A<\/strong><\/p>\n

\"Phishing
Image: Bitdefender. Phishing email impersonating Canadian company Ultramar.<\/figcaption><\/figure>\n

As can be seen in Figure A<\/strong>, the email contains text in both English and French language, but most importantly an attached file named Invoice_32566.one \u2014 the .one file extension indicating a OneNote file.<\/p>\n