OneNote documents have emerged as a new malware infection vector

OneNote attachments have emerged as a new infection vector for malware distribution, as a result of Microsoft disabling VBA macros on documents. Malicious actors can embed file formats, such as HTML, ISO, and JScripts, into OneNote attachments, making them interactive and appealing to users. Attackers often use social engineering techniques via email to persuade victims to download and execute OneNote attachments. Traditional security tools are not effective in detecting these types of threats, and analysts should use dynamic analysis and Oletools to detect and analyze malicious code. Prevention is the best defense, and security teams should update their systems and educate employees on the dangers of downloading unknown and untrusted attachments.