Threat Actor Uses OneNote to Learn Credential Phishing

Phishing Defense Center analyzes phishing emails with malware payloads that bypassed email gateways. 100% of the threats found by the Cofense PDC were identified by the end user. 0% were stopped by technology. The CofENSE PhishMe template based on this threat is based on the Order Invoice-Agent Tesla Keyloggers template. The company first saw this OneNote campaign on January 20th, 2020 and quickly deployed temporary protections. By February 7th, FireEye had added a new OneNote detection capability to FireEye Email Security.”]

Source: https://cofense.com/threat-actor-uses-onenote-learn-credential-phishing-evade-microsoft-fireeye-detection/