Hackers hide behind Microsoft’s own websites to bypass email filters and launch phishing campaigns
- Attackers abused Microsoft Power BI dashboards to entice victims to download ScreenConnect software
- The public panels mimicked blurred documents and redirected users to attacker-controlled sites.
- The campaign established persistent remote access, which could allow ransomware, espionage, or data theft.
Microsoft’s Power BI has apparently become the latest in a growing line of legitimate software being abused in phishing attacks.
Security researchers Huntress said they discovered a new campaign that leverages publicly accessible Power BI dashboards to trick people into downloading remote monitoring and management (RMM) software called ScreenConnect. The end of the campaign is not known at the moment.
BI Energy
Power BI is Microsoft’s business intelligence and data visualization platform, allowing users to create charts, reports, and various dashboards from their data and other raw information. The tool itself can collect data from sources such as spreadsheets, databases, cloud services, and more, and users can publish reports and dashboards online, or share them with colleagues privately.
Latest videos ofTechnologyRadar
In this campaign, which began around September 10, 2026, threat actors created a public dashboard, likely using a disposable (or a compromised) Microsoft account. Huntress doesn’t confirm how that account was obtained, but says the dashboard was designed to look like a blurry document with a button called “Download Reference.”
The blurred document trick is quite common in phishing emails. Other services like DocuSign, Dropbox, and even Office 365 suffered from the same abuse. To “unfocus” (or unlock) the document, victims are asked to click on a link and follow it.
Sometimes they were asked to download a “premium” version of a document reader, or an “updated” one, and other times they were asked to sign in with their Office or Google credentials. This attack is no different: clicking the “Download Reference” button redirects the victim to an attacker-controlled website outside of Microsoft’s infrastructure, where an automatic ScreenConnect download is initiated.
On its own, ScreenConnect is not malicious. It is a legitimate remote access and support tool developed by ConnectWise and designed to help IT staff manage devices remotely. Through the product, users can connect other devices to the Internet, troubleshoot, transfer files, and install software. Once installed and connected to an attacker-controlled endpoint, ScreenConnect can provide persistent remote access.
Establishing persistence
Investigators did not discuss how the emails were delivered, but since they contained a link to a legitimate Microsoft service, they most likely evaded at least some email filters and landed in people’s inboxes. After all, this is probably why Power BI was used in the first place (aside from the fact that it’s not often abused this way).
But what’s particularly interesting about this attack is that after deploying one instance of ScreenConnect, the attackers deployed a second one and set up a scheduled task to repeatedly execute a PowerShell script. In at least one incident, they also deleted the first instance.
Why they did it remains a mystery. An educated guess would be that they were trying to establish reliable and persistent remote access, while also ensuring that their activities were harder to detect and disrupt. If defenders were to discover and remove one malicious installation of ScreenConnect, it is possible that a second one would be available.
Unfortunately, this is all in the realm of speculation, as Huntress stopped the observed attack before it progressed beyond establishing remote access. Therefore, we do not know whether the goal was to steal data, deploy ransomware, or engage in financial fraud. What we do know is that with two ScreenConnects they were able to establish a lasting foothold within corporate networks, which they could later exploit for espionage, data theft, ransomware or other financially motivated attacks.
As a general rule, the best way to defend against these types of attacks is to be very skeptical of incoming emails, especially those with links to “locked” documents, and even more so those that end with a ScreenConnect implementation.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment