From Innocence to Malice: The OneNote Malware Campaign Uncovered


March 30, 2023
By Saharsh Agrawal

OneNote has been highly cherished by Threat Actors (TAs) in recent months. Unfortunately, many malware distributors have taken notice and are now using OneNote to deliver malicious files to their victims. These actors attach malicious files to a page within OneNote and then share it with their targets as a .one file. The ONE file reaches its targets through phishing emails. Upon opening the attachment, the victim’s computer is compromised.

OneNote Malware Campaign
Figure 1: Overview of OneNote Malware Campaign


The inclusion of the MoTW flag and disabling macros in Microsoft Office applications has resulted in a notable reduction in the use of MS Word and other executables for distributing malware. OneNote enables its users to attach files without constraints, making it a convenient means for TAs to deliver malicious payloads. To address this concern, Microsoft has introduced a warning dialog box that prompts users when attempting to open an attachment.

Evolution in Malware Distribution
Figure 2: Evolution in Malware Distribution

How TAs are using OneNote

OneNote malware campaign is propagated via phishing emails, with Emotet being the latest malware to take part in this campaign. The attackers employ a tactic of deception by displaying a counterfeit button, concealing the actual harmful attachment underneath it. Victims are lured into clicking the button with the promise of accessing the document upon clicking the fake button. Nviso Labs also reported the use of embedded URLs by the TAs to deliver their payload.

OneNote Attachments

The threat actors have been disseminating the malware by using various file types as attachments. Our findings reveal that the primary purpose of these attachments is to download and execute the intended malware. Presented below is a list of some file extensions that the TAs favor.

  • .bat
  • .js
  • .cmd
  • .wsf
  • .ps
  • .lnk
  • .exe
  • .hta
  • .vbs

One noteworthy technique that was observed involved the use of Right-to-Left Override to masquerade the file extension. The malware has also been seen with double file extensions in order to evade detection.

In late November 2022, Qakbot was observed utilizing OneNote to distribute its malware and since then, numerous threat actors have followed suit, taking advantage of this feature. This campaign has brought together multiple malware families and integrated them into a unified approach. Threat actors still continue to incorporate OneNote as a tool in their arsenal for delivering their malware.            

The chart below illustrates the distribution trend of malware by various TAs in the last four months. OneNote has been extensively used by Qakbot in recent months, which is evident from the chart. Emotet joined the campaign in March and has been consistently active since then. Meanwhile, AsyncRAT has shown a gradual rise in the number of malwares detected over the months, with a halt in March.

The OneNote Malware Campaign displayed no bias towards specific malware categories as it welcomed all types of malwares, including info-stealers and ransomware, with open arms.

A list of some popular malware utilizing the OneNote malware campaign that was observed, is provided below.

Malware samples using OneNote can be found in MalwareBazaar, and there are open-source tools developed by DidierStevens and knight0x07 that will be helpful for static analysis of the .one file format.


As we mentioned earlier, the campaign is being spread through emails. An adequate way for your organization to protect itself is by either creating a rule in Microsoft Exchange Online or by creating a new Anti-malware policy to block emails containing .one files as attachments.

If these options are not feasible, you can limit the launching of embedded file attachments in OneNote by utilizing Microsoft Office group policies.

Creating an Attack Surface Reduction (ASR) rule on `D4F940AB-401B-4EfC-AADC-AD5F3C50688A` as shown below will help prevent the execution of OneNote attachments. If a user tries to open the attachment, they will receive a notification alerting them that the administrator has blocked this action.

Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EfC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled


OneNote Malware Campaign can be detected using sigma rules.

The below rule detects the creation of .one file in users machine.

    category: file_event 

    product: windows 




            - '\AppData\Local\Temp\' 

            - '\Users\Public\' 

            - '\Users\' 

            - '\Windows\Temp\' 

            - 'C:\Temp\' 

        TargetFilename|endswith: '.one' 

    condition: selection 

As we highly observed the use of RUNDLL32 for the execution of the malware where the attachment was an .hta file. This behavior can be detected using the following rule. 


  product: windows 

  category: process_creation 



    Image|contains: 'rundll32.exe' 

    ParentImage|contains: 'mshta.exe' 


      - '.hta' 

      - 'OneNote' 

  condition: selection_process 

All the attachments that we open from OneNote without saving them first is temporarily saved to the following path. 


The rule mentioned below was written on the above scenario on attachments with suspicious file extension. 


  category: file_event 

  product: windows 




      - '\onenote.exe' 

      - '\ONENOTE.EXE' 


      - '\AppData\Local\Temp\OneNote\' 

      - '\Exported\' 

      - '\NT\' 



      - '.bat'
      - '.dat'
      - '.exe'
      - '.hta'
      - '.vba'
      - '.vbe'
      - '.vbs'
      - '.wsh'
      - '.wsf'
      - '.js'
      - '.scr'
      - '.pif'
      - '.cmd'
      - '.chm'
      - '.ps'
      - '.lnk'
      - '.ps1'
      - '.ps2'
      - '.jse' 
  selection_file_right2left: # FileContaining Right-to-Left Override 
    TargetFilename|re: ^.*U+202E.*$ 
  selection_file_doubleExt: # File with Double File Extension 
    TargetFilename|re: ^.*\.[a-zA-Z0-9]*\.[a-zA-Z0-9]*$ 
  condition: selection_image and 1 of selection_file*

Additional detections for this campaign have been shared by mbabinski and SigmaHQ for the community.

For more threat analytics reach us here.

MITRE ATT&CK Techniques

TacticTechnique IDTechnique Name
Initial AccessT1566.001 
Phishing: Spearphishing Attachment 
Phishing: Spearphishing Link 
Command and Scripting Interpreter: PowerShell 
Command and Scripting Interpreter: Windows Command Shell 
Command and Scripting Interpreter: Visual Basic 
Command and Scripting Interpreter: JavaScript 
Defense Evasion T1036.002 
Masquerading: Right-to-Left Override 
Masquerading: Double File Extension 
Obfuscated Files or Information: Embedded Payloads 
Process Injection: Portable Executable Injection 
System Binary Proxy Execution: Compiled HTML File 
System Binary Proxy Execution: Mshta 
System Binary Proxy Execution: Regsvcs/Regasm 
System Binary Proxy Execution: Rundll32 
Command and Control T1105 
Ingress Tool Transfer 
Remote Access Software

Threat Bites

Threat Name


Threat Actor

Targeted Country

Targeted Industry

First Seen

Last Seen 














OneNote Malware Campaign 

Malware Distribution Channel

TA551, TA2541, TA558, TA542, APT33, TA577, TA558


Shipping, Manufacturing and Aerospace

November 2022

March 2023

Wmic,Reg, Rundll32, Mshta, Regasm, Regsvcs

sysmon, security, windefend, powershell

To uncover the dark secrets of the Aurora Stealer Malware, check out the blog!

Author: Saharsh Agrawal
Security Researcher, Loginsoft