The Rising Trend of OneNote Documents for Malware delivery

This report analyzes malicious OneNote documents used in phishing campaigns to distribute Qakbot and other malware families. It details OneNote file structure (FileDataStoreObject), an automated extraction method for embedded artifacts, two Qakbot campaign infection chains (HTA- and batch-based droppers that download DLL payloads executed via rundll32/mshta/powershell), runtime behavior, and provides associated IOCs and a malicious domain.