OneNote File Extraction Reveals Embedded Malware Payloads
What Happened — Researchers analyzing a recent wave of malicious campaigns discovered that threat actors are embedding executable payloads inside Microsoft OneNote files (.one). By leveraging the OneNote file format’s ability to store embedded objects, attackers can slip malicious binaries past conventional email and endpoint scanners. The embedded files are extracted using a straightforward parsing technique that unpacks the hidden objects for later execution on the victim machine. The activity was first reported by the SANS Internet Storm Center on 1 Nov 2026 and is being observed across multiple phishing emails targeting corporate users.
Why It Matters for Trust & Control Assurance — The technique underscores the need for robust file‑validation and deep‑content scanning controls, a single control objective that satisfies audit requirements across many frameworks.
Who Is Affected — Technology‑SaaS providers, financial services, healthcare IT, and any organization that accepts Office documents from external sources.
Recommended Actions
- Deploy content‑inspection solutions that can parse and scan OneNote files for embedded binaries.
- Update malware detection signatures to include the
.oneformat extraction patterns. - Log all attempts to open or extract content from Office documents and retain logs for audit evidence.
- Incorporate file‑validation controls into your continuous compliance monitoring program.
Technical Notes
- Attack vector: File‑format abuse – malicious payload hidden in OneNote (
.one) files. - Tools/techniques: Simple parsing scripts that enumerate embedded objects within the OneNote package.
- Impact: Enables execution of malware that may evade traditional email gateways and endpoint AV.