New Attacks, Old Tricks: How OneNote Malware is Evolving

This report analyzes a OneNote-based malware sample that embeds HTA, WSF and VBScript artifacts which, when executed by a user, run PowerShell downloaders to fetch and execute additional payloads. The author presents static analysis of the extracted scripts and URIs, demonstrates how malicious files are hidden behind a faux UI element in OneNote, and recommends mitigations including user awareness, a Sysmon detection rule, disabling Windows Script Host, and enforcing signed PowerShell execution.