A recent phishing campaign used OneNote to distribute the Agent Tesla keylogger.
Source: Threadpost