Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
Huntress reported a phishing campaign, active since September 10, 2026, that uses legitimate Microsoft Power BI pages to deliver attacker-controlled ScreenConnect installers. An Outlook link opens a blurred Power BI reference view whose download button leads to staging sites that fingerprint the visitor before serving the installer. The first client deploys a second ScreenConnect instance with PowerShell, removes itself, runs an evasion tool, and in one case used a scheduled task every two minutes. Huntress saw several affected endpoints and the same configuration on 22 additional historical endpoints; no group or data theft was confirmed.
- Observed from September 10, 2026, using real Microsoft Power BI links.
- Staging pages fingerprint visitors and report activity to Telegram.
- Two ScreenConnect clients create redundant remote-access paths.
- PowerShell and a two-minute scheduled task deployed the second client.
- No named threat group or confirmed data theft was reported.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1219 Remote Access SoftwareT1059.001 PowerShellT1053.005 Scheduled Task
- Vendors
- MicrosoftConnectWise
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | app.powerbi.com | xecution Filename HideUL_x64.exe Evasion tool URL hxxps[://]app[.]powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJm |
| domain | burnsworth.site | s[://]dailylifeproject[.]site/S/ Staging page URL hxxps[://]burnsworth[.]site/S/main.html Staging variant URL hxxps[://]essaywritingser |
| domain | dailylifeproject.site | IzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 Reference lure URL hxxps[://]dailylifeproject[.]site/S/ Staging page URL hxxps[://]burnsworth[.]site/S/main.ht |
| domain | essaywritingservice.site | burnsworth[.]site/S/main.html Staging variant URL hxxps[://]essaywritingservice[.]site/S/main[.]html Staging variant URL hxxps[://]openpediatric |
| domain | hamham27.screenconnect.com | Redirect check.vykyn[.]click/E/ Failed checks URL hxxps[://]hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=IL |
| domain | instance-g01s1n-relay.screenconnect.com | up.exe?e=Access&y=Guest&t=PAPASUPE Installer variant Domain instance-g01s1n-relay[.]screenconnect[.]com Initial relay Domain onthegotree[.]site Secondary infra |
| domain | onthegotree.site | nce-g01s1n-relay[.]screenconnect[.]com Initial relay Domain onthegotree[.]site Secondary infrastructure URL hxxps[://]onthegotree[.]site |
| domain | openpediatrics.site | gservice[.]site/S/main[.]html Staging variant URL hxxps[://]openpediatrics[.]site/S/main.html Staging variant Redirect check.vykyn[.]click/ |
| domain | vykyn.click | ediatrics[.]site/S/main.html Staging variant Redirect check.vykyn[.]click/E/ Failed checks URL hxxps[://]hamham27[.]screenconnect[. |
| sha256 | 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 | Indicators of compromise (IoCs) Type Indicator Role SHA-256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 Initial client SHA-256 f048400c23add8c75abe189393d33c873c02 |
| sha256 | f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 | 15be98783963769a12020c93ce05e749b3c3 Initial client SHA-256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 Secondary client Client ID 2b302081e9e777d0 Initial instanc |
From the original article
4 min read at cybersecuritynews.com
A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems. The operation uses a fake reference document hosted on Microsoft’s real service, making the opening link appear safe before directing victims to attacker-controlled download pages. The attack does not depend on a reported […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.