A malware campaign using the Qbot (aka QakBot) banking trojan has been identified in the wild that is spread through malicious Microsoft OneNote .one attachments. This malware campaign has been referred to as ‘QakNote’ due to the trojan used and the method of using Microsoft OneNote files. It has been observed by security researchers at Sophos and Cynet since 31 January 2023 in “message thread injections”, where the reply-to-all function of an email is sent from an infected device with the malicious OneNote file attached. A parallel spam campaign with direct but impersonal message that contains a link to download the malicious .one file in the body of the email was also observed.  

The Qbot banking trojan-turned-malware is used to gain initial access to devices, which then allows the attackers to load additional malware onto the compromised device. Attackers can then exfiltrate data, install ransomware, and perform further malicious acts across an entire network. The use of OneNote files attachments to spread malware was identified last month in phishing campaigns, where threat actors were looking for alternative methods to compromise systems after Microsoft disabled macros in Office documents back in July of 2022. Using OneNote documents as an attack vector is appealing to malicious actors as they can embed almost any file type including VBS attachments and LNK files.  

User interaction is needed for this attack to be successful, as in order for the embedded files containing the malware to be executed they must be clicked on by the user. However, because current email threads are being hijacked to distribute the .one files, users are likely to open the files as they appear to come from a known sender. If the Qbot malware is successfully run, the DLL payload injects itself into the Windows Assistive Technology manager in order to hide from any antivirus tools that may be running on the infected device. Because of this malware’s evasion techniques, the best way to mitigate against this threat is for email administrators to block all .one file extensions. These files are not commonly sent as attachments so this should not cause any disruption to normal and expected communication.