Payload Trends in Malicious OneNote Samples

This Palo Alto Networks analysis examines ~6,000 malicious Microsoft OneNote samples used as phishing vehicles that embed scripts and binaries (most commonly JavaScript and PowerShell) to deliver payloads; it describes how embedded objects are identified (GUID FileDataStoreObject), payload type and size distributions, prevalence of image-based lures, and provides an EXE/shellcode case study showing dynamic API resolution and a network callback, plus IOCs and mitigation recommendations.