Multiple Malware Variants Distributed Through Microsoft OneNote

Spear-phishing emails with malicious Microsoft OneNote attachments were discovered delivering variants from the AsyncRAT, Formbook¸ Remcos, and XWorm malware families.
Multiple legitimate Microsoft Windows utilities were used to carry out the operation including cmd, BITSAdmin, PowerShell, wscript, and curl.
The adversary took advantage of the right-to-left override (RTLO or RLO) technique to convince the victim to execute files which appeared to be benign.