Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs

Key Takeaways

• A sophisticated phishing campaign is leveraging legitimate Microsoft Power BI services to distribute malicious ScreenConnect remote monitoring and management (RMM) software.
• The attack chain begins with a phishing email leading to a seemingly benign Power BI link, which then redirects victims to attacker-controlled download pages.
• This campaign does not exploit a Power BI vulnerability but rather abuses trust in the platform to establish persistent remote access on Windows systems.
• Attackers deploy two distinct ScreenConnect clients, with the second client designed to evade detection and maintain access even if the initial compromise is discovered.

Microsoft Power BI Abused in ScreenConnect Phishing Campaign

A new phishing campaign is actively exploiting Microsoft Power BI to facilitate the deployment of illicit ScreenConnect installations, granting threat actors persistent remote access to compromised Windows systems. This operation cunningly leverages the credibility of Microsoft’s service to mask its malicious intent, making initial links appear safe to unsuspecting users.

Unlike attacks that exploit software vulnerabilities, this campaign capitalizes on user trust in familiar business platforms. By hosting a fake reference document on Microsoft’s legitimate Power BI service, attackers can guide victims to download pages under their control. The deployed ScreenConnect software, while a legitimate tool for remote support, is configured to connect to attacker-controlled infrastructure, turning a trusted application into a conduit for malicious activity.

Researchers from Huntress identified this campaign commencing on September 10, 2026, and provided a detailed analysis in their Power BI phishing report, published on October 7. Their observations revealed multiple affected endpoints. A broader historical investigation by Huntress uncovered the same unique client and configuration across 22 additional endpoints in unrelated incidents, suggesting a wider pattern of this attack methodology.

The Phishing Chain: From Outlook to Rogue RMM

The attack sequence typically initiates with a phishing email, often sent via Outlook, although the specific initial message could not be recovered by Huntress. The email’s embedded link directs recipients to a blurred reference form hosted on Power BI, featuring a prominent “Download Reference” button. This tactic mirrors other ScreenConnect payment phishing schemes where expected documents are replaced with remote access installers, underscoring the critical importance of scrutinizing download contexts.

Huntress explained that threat actors have previously established public Power BI dashboards through accounts they manage, which may include compromised or disposable credentials, and then embedded malicious links within these dashboards. Because the initial URL points to a legitimate Microsoft domain, many security gateways that trust the domain may permit the email to bypass their defenses. The real danger materializes once the user interacts with the deceptive download prompt.

Upon clicking the “Download Reference” button, victims are redirected to an attacker-controlled webpage. This page performs a series of reconnaissance checks, including the visitor’s operating system, browser version, screen size, user-agent string, and indicators of automation. This information, along with IP addresses, location, browser details, and download activity, is then transmitted to a Telegram bot. Visitors who fail these preliminary checks, potentially identified as security researchers or automated scanners, are redirected away from the malicious payload.

One specific variant of the staging page was observed to accept Windows desktop systems while actively filtering out traffic originating from Microsoft or unknown internet service providers, a clear attempt to evade detection by security analysis tools and researchers. Following a brief delay, JavaScript on the page activates a hidden download link and subsequently displays a message falsely confirming the successful download of the reference verification form. It is crucial to note that merely downloading the installer does not equate to its execution.

Dual Clients for Persistent Remote Access

The initial installer is sourced from a ScreenConnect tenant that is reused across various attack iterations, differentiated by unique guest-access parameters. This setup establishes a primary rogue client connected to a ScreenConnect relay. This first client then proceeds to install a second client, which links to entirely separate attacker infrastructure. This dual-client approach has been observed in other legitimate RMM phishing campaigns, indicating a broader trend of abusing trusted support applications, though it does not necessarily imply shared threat actors.

In one incident, the initial client executed a command file that deployed a PowerShell script from a temporary directory. This script was responsible for downloading and executing the secondary installer, after which it removed the first ScreenConnect instance. Huntress assessed this removal as a likely attempt to evade detection by security systems and analysts.

Furthermore, attackers were observed deploying a tool that Huntress believes is designed to conceal their activities from both users and security software. In a specific case, a scheduled task was configured to run a repair script every two minutes, a persistent mechanism that was only halted when the security operations center intervened. The use of multiple clients provides attackers with redundant access routes, ensuring persistence even if one point of compromise is identified and remediated.

The report does not identify a specific threat group or confirm any data exfiltration. Its primary focus is on detailing the delivery chain and the methods used to establish persistent access, rather than confirming a ransomware event or similar outcome. For cybersecurity defenders, the critical distinction lies in ownership: a legitimate remote support application becomes a significant threat when an unauthorized party controls its connections and deceptively installs it through misleading document requests.

What You Should Do

• Review Phishing Controls: Enhance email security gateways to scrutinize links from trusted cloud services more rigorously, especially those leading to downloads.
• Monitor RMM Installations: Implement robust monitoring for any unexpected installations or configurations of remote monitoring and management software like ScreenConnect on your network. Restrict the use of remote tools to approved, managed instances only.
• Investigate Anomalous Activity: Promptly investigate instances of multiple RMM clients, unusual PowerShell scripts, or newly created scheduled tasks on endpoints.
• Correlate Security Events: Develop capabilities to correlate download events, program execution, and outbound network traffic to distinguish legitimate remote support activities from malicious attacker access.
• Educate Users: Conduct regular security awareness training emphasizing the dangers of clicking suspicious links, even those appearing to originate from trusted services, and the importance of verifying download contexts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.