Tactic or Technique: OneNote

Attackers use OneNote files to hide malware or phishing links inside interactive elements like buttons, images, or text boxes. These files are often sent as attachments with subject lines about invoices, shipping updates, or other urgent business topics.

When opened, the page may look like a login screen or document preview and prompt you to click. That click can launch a PowerShell script, download malware, or redirect you to a phishing site.

This tactic works because OneNote files often bypass security filters that focus on more traditional attachments like Word or PDFs. Most tools don’t scan them as deeply, which gives attackers a way to evade detection and gain a foothold in your environment.