Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access

A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.

The operation uses a fake reference document hosted on Microsoft’s real service, making the opening link appear safe before directing victims to attacker-controlled download pages.

The attack does not depend on a reported Power BI software flaw. Instead, it turns trust in a familiar business platform into a delivery route for remote monitoring and management software, or RMM.

ScreenConnect is legitimate support software, but these installations connect victims to infrastructure controlled by attackers.

Researchers from Huntress identified the campaign starting September 10, 2026, and detailed it in their Power BI phishing report, published October 7.

They observed several affected endpoints. A separate historical hunt found the same unique client and configuration on 22 additional endpoints across separate incidents, not necessarily this exact campaign.

Microsoft Power BI Phishing Campaign

The chain began with an Outlook phishing email, although Huntress could not recover the original message. Its link opened a blurred reference form on Power BI with a “Download Reference” button.

Similar ScreenConnect payment phishing attacks also replace expected documents with remote access installers, showing why download context matters.

Huntress explains that attackers have previously created public Power BI dashboards through accounts they control, including compromised or disposable accounts, and embedded malicious links inside them.

Since the first address belongs to Microsoft, security gateways that trust the domain may let the message through. The danger appears after the user follows the fake reference download prompt.

Clicking the button opened an attacker-controlled page that checked the visitor’s operating system, browser version, screen size, user-agent, automation signs, and other details.

It sent IP addresses, location, browser information, and download activity to a Telegram bot. Visitors who failed the checks were redirected elsewhere.

One variant accepted Windows desktop systems while filtering Microsoft or unknown internet service providers. These checks helped screen out scanners and researchers.

After a short delay, JavaScript activated a hidden download link, then displayed a message claiming the reference verification form had downloaded successfully. Downloading the installer alone was not evidence of execution.

Two Clients Extend Remote Access

The initial installer came from a ScreenConnect tenant reused across variants, with different guest-access parameters. It established one rogue client connected to a ScreenConnect relay, which then installed another client linked to separate attacker infrastructure.

Earlier legitimate RMM phishing campaigns show the same broader reliance on trusted support applications, without proving shared operators. In one incident, the first client ran a command file that deployed a PowerShell script from a temporary directory.

The script downloaded and executed the second installer, then removed the first ScreenConnect instance. Huntress assessed that removal as a likely attempt to avoid detection.

Attackers also executed a tool Huntress assessed as designed to hide their activity from users and security software. In one case, a scheduled task ran the repair script every two minutes before the security operations center stopped the attack.

Multiple clients can leave another access route after defenders remove one. The report does not name a threat group or establish that data was stolen. Its findings describe the delivery chain and persistent access, rather than a confirmed ransomware event.

For defenders, the important distinction is ownership: a real remote support application becomes dangerous when an unknown party controls its connection and installs it through a misleading document request.

Huntress recommends reviewing phishing controls for trusted cloud links, monitoring unexpected ScreenConnect installations, and restricting remote tools to approved instances.

Teams should investigate multiple RMM clients, unusual scripts, and new scheduled tasks. Connecting downloads, execution, and outbound traffic, as explained in detecting trusted tool abuse, helps distinguish authorized support from attacker access.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access appeared first on Cyber Security News.