➡️ Malspam mail being delivered with attached onenote document And even some less popular malware delivery techniques, such as HTML smuggling, started gaining ground.īut by the beginning of 2023, it became obvious that attackers have also begun to rely on trojanized OneNote documents to deliver a variety of malware. The reason for the switch was that they did not – at the time – show security warnings when victims tried to open them. When last July Microsoft started blocking VBA macros from running by default in Office files obtained from the internet, attackers began using container file formats (ISO, RAR, ZIP) and IMG files to deliver LNKs, DLLs, or executables to install malicious payloads on the target’s computer. “Users will receive a notification when the files seem dangerous to improve the file protection experience in OneNote on Windows,” the company said. Microsoft has announced that, starting in April 2023, they will be adding enhanced protection when users open or download a file embedded in a OneNote document – a known high-risk phishing file type.

One note for web