How do malicious OneNote attachments bypass antivirus checks in email?

THEY HIDE EXECUTABLE FILES UNDER FAKE GRAPHIC BUTTONS INSIDE A DIGITAL NOTEBOOK.

Files with the .one extension were not recognized by security gateways as potentially dangerous containers for a long time. Fraudsters embed a malicious script inside a note and cover it with a bright button urging the user to click to view the document.

Exploiting Trust in Office Note Formats

Microsoft OneNote allows attaching arbitrary files directly to the canvas of an electronic page. An attacker places an executable batch file or PowerShell script, and overlays an image with the text "Open Invoice". Double-clicking the image initiates the launch of the hidden file, bypassing standard macro blocking.

Rules for Protection Against Hidden Scripts in Notes

Block incoming email attachments with .one and .onetoc2 extensions at the mail server level
Pay attention to system security warnings when double-clicking elements inside a notebook
Never confirm the execution of external scripts packaged in third-party office notes
Open files from untrusted counterparties exclusively in an isolated virtual sandbox