onenoteonlinesync.onenote.com

Phishing Download Exfiltration

Attackers can insert an attachment on a OneNote Notebook and then use the attachment's direct download link to phish users.

None

Attackers can insert files they wish to exfiltrate on a OneNote Notebook and send the direct download link to themselves. This method is not ideal for large files due to the file size restriction in place.

Attackers can insert an attachment on a OneNote Notebook and then use the attachment's download link to directly download the file.

https://twitter.com/mrd0x/status/1475085452784844803