Security researchers have noted a recent uptick in phishing campaigns utilizing Microsoft OneNote attachments to spread malware. Phishing emails typically contain Microsoft Word documents or Excel files that are embedded with malicious macros as well as ISO images or password-protected ZIP files. With Microsoft disabling default macros, threat actors have turned to OneNote, the digital notebook application included by default in Microsoft Office 2019 and Microsoft 365, which can be used to open the OneNote file format despite not being used by the user. In December 2022, Trustwave SpiderLabs researchers noted actors leveraging Microsoft OneNote documents to spread the “Formbook” malware, an information-stealing trojan sold as malware-as-a-service since mid-2016. Once the attachment was opened, a large “View Document” image was shown over a blurred document that had malicious attachments underneath. When the researchers clicked on the image (and hidden attachments), a Windows Script File (WSF) was executed, and a standard security warning was shown. If a user was to click “OK” on the warning, a decoy OneNote file and an executable containing the malware payload would be downloaded. Threat actors then have the ability to remotely access the compromised device to exfiltrate files, save browser passwords, and take screenshots. Rare cases of recording video with the machine’s webcam have also been identified. Additional campaigns have been recently identified leveraging OneNote, including campaigns using DHL shipping notification, invoice, ACH Remittance form, mechanical drawing, and shipping document lures. CTIX analysts urge Microsoft users to be vigilant against suspicious emails and, if an attachment prompts a security warning upon opening, to reevaluate the received email and attachment.