Phishing Scam: OneNote Files Being Used in Phishing Attacks

Dear McMaster Community, 

We want to make you aware of a potential phishing vulnerability involving malicious OneNote files that may be circulating via email or shared links. 

What’s Happening 

Cybersecurity teams have identified that attackers are using embedded content in OneNote files (such as executable links or scripts) to trick users into clicking harmful elements. The following images provide examples of how attackers embed malicious content within OneNote files. 

Initial Phishing Email Inviting Recipients to Edit a File: 

OneNote Invitation Containing ‘VIEW DOCUMENT’ Button Leading to Credential Theft or Malware Installation: 

These files may appear legitimate but can lead to credential theft or malware installation. 

What You Should Do 

1. Do not open OneNote files from unknown or unexpected sources. While OneNote shares coming from a known sender may appear legitimate, the sender’s email account may have been compromised by attackers and then used to send malicious files. 
2. Verify links before clicking. Attackers can embed harmful links in Microsoft 365 shared documents that lead to fake login pages or malicious websites designed to steal your password. These links often mimic legitimate URLs by using subtle misspellings or extra characters. 
3. Report Suspicious Messages to IT Security for review. Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
4. Educate Yourself by learning about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world. 

We’re actively monitoring the situation and will provide updates as needed. Your vigilance helps protect our entire McMaster community. 

Thank you for your attention and cooperation.