Phishing is nevertheless still active and kicking
This blog post by SSE provides an insight into techniques and procedures for phishing in 2023. It walks through delivery, mail gateway filters, Mark-of-the-Web (MOTW) bypasses and execution with Microsoft Office documents, now that VBA macros from untrusted sources are blocked by default. A February update adds CVE-2023-21715, a Microsoft Publisher security feature bypass that let macros in .pub files ignore MOTW. The post also lists OneNote as a popular wrapper, and Proofpoint counted more than 50 OneNote malware campaigns in January 2023, up from six in December 2022, including TA577 delivering Qbot. Blocking macros did not end phishing; it mostly changed the file extension.