BTC $70614.7035
ETH $3511.7004
BNB $620.2579
SOL $173.0218
XRP $0.6097
stETH $3507.5030
DOGE $0.1974
TON $7.0340
ADA $0.5814
AVAX $46.2782
wstETH $4079.6154
DOT $8.3856
BCH $610.3232
WETH $3506.2796
WBTC $70620.3107
TRX $0.1214
LINK $17.6767
MATIC $0.8810
UNI $9.1130
LTC $98.3227
ICP $15.5376
CAKE $3.7378
DAI $0.9997
IMX $2.5624
ETC $33.6826
RNDR $9.0476
STX $3.0152
FIL $8.0739
MNT $1.3057
TAO $634.6650
NEAR $6.7707
HBAR $0.0996
ATOM $10.7689
VET $0.0473
OKB $56.7850
WIF $3.4067
FDUSD $1.0024
KAS $0.1425
MKR $3339.9801
PEPE $0.0000
GRT $0.3118
THETA $2.9461
INJ $31.7489
FET $2.5268
XLM $0.1299
XMR $133.8901
USDE $1.0008
BTC $70614.7035
ETH $3511.7004
BNB $620.2579
SOL $173.0218
XRP $0.6097
stETH $3507.5030
DOGE $0.1974
TON $7.0340
ADA $0.5814
AVAX $46.2782
wstETH $4079.6154
DOT $8.3856
BCH $610.3232
WETH $3506.2796
WBTC $70620.3107
TRX $0.1214
LINK $17.6767
MATIC $0.8810
UNI $9.1130
LTC $98.3227
ICP $15.5376
CAKE $3.7378
DAI $0.9997
IMX $2.5624
ETC $33.6826
RNDR $9.0476
STX $3.0152
FIL $8.0739
MNT $1.3057
TAO $634.6650
NEAR $6.7707
HBAR $0.0996
ATOM $10.7689
VET $0.0473
OKB $56.7850
WIF $3.4067
FDUSD $1.0024
KAS $0.1425
MKR $3339.9801
PEPE $0.0000
GRT $0.3118
THETA $2.9461
INJ $31.7489
FET $2.5268
XLM $0.1299
XMR $133.8901
USDE $1.0008
  • Catalog
  • Blog
  • Tor Relay
  • Jabber
  • One-Time notes
  • Temp Email
  • What is TOR?
  • We are in tor
  • The notorious Emotet malware now spreads through Microsoft OneNote files

    The attackers had to change the delivery channel after the recent actions of the Redmond company.

    Emotet malware, which we reported on recently after a long hiatus, is now spreading via Microsoft OneNote email attachments in an effort to bypass Microsoft's latest security restrictions and infect more computers.

    Emotet is a known malicious botnet that has historically spread through Microsoft Word and Excel email attachments containing malicious macros. If a user opens such an attachment and activates macro support, this causes a malicious DLL to be downloaded and executed, which installs the Emotet malware on the victim's computer.

    Once downloaded, the malware can steal contacts and emails for future spam campaigns. Emotet can also be used to install other payloads that provide initial access to the corporate network for subsequent cyberattacks.

    With Microsoft now automatically blocking macros in uploaded Word and Excel documents, including files attached to emails, the Emotet malware campaign has become dramatically ineffective. However, the attackers quickly reacted to the steps taken by Microsoft and began to distribute malware through OneNote attachments.

    The image above shows an example of such an attack. The phishing email has a Microsoft OneNote file attached. Inside it contains a fake message that the document is protected, and for correct viewing, you need to double-click the "View" button. However, just under this button, the attackers hid a malicious VBScript file called "click.wsf", the launch of which leads to the execution of malicious code.

    The above VBScript contains a convoluted script that downloads a DLL from a remote website and then executes it.

    Although OneNote displays a warning when a user tries to run embedded content in a file, statistics show that many users often click the OK button just to get rid of the warning without reading the text and thinking about the possible consequences.

    Microsoft is already aware of the problem and will soon add improved protection against phishing documents to OneNote, but the exact date when the update will become available to everyone has not yet been named.

    As a workaround, Windows system administrators can use Group Policies to completely or partially block inline scripts in Microsoft OneNote files.

    Author DeepWeb
    New ScrubCrypt crypter used in cryptojacking attacks targeting Oracle WebLogic
    BATLOADER malware uses Google Ads to deliver Vidar and Ursnif infostealers

    Comments 0

    Add comment