Qakbot’s Evolution Continues with New Strategies

This report describes an active Qakbot spam campaign that delivers malware through malicious Microsoft OneNote attachments: opening the OneNote drops and executes an attachment.hta via mshta.exe, which stores obfuscated data in the registry, uses curl to download a .dat (persisted as a .png Qakbot DLL) to %ProgramData% and launches it with rundll32.exe, followed by process injection for data theft. The analysis includes the full infection chain, observed behaviors, recommended mitigations, MITRE ATT&CK mappings, and specific IOCs (SHA256 hashes and a download URL).