Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Phishers abused Microsoft Power BI dashboards to push rogue ScreenConnect RMM clients, creating redundant persistent remote access on 20-plus endpoints.
Huntress tracked a campaign starting September 10, 2026, where Outlook phishing emails linked to public Power BI dashboards on app.powerbi.com redirected victims to attacker domains such as dailylifeproject[.]site. Fingerprinting pages filtered scanners and delayed the download of a rogue ScreenConnect installer, while a Telegram bot exfiltrated victim IP, geolocation, and browser telemetry. A PowerShell scheduled task (SCAutoFix.ps1, run every 2 minutes) installed a second ScreenConnect client and removed the first, likely for detection evasion, alongside the HideUL_x64.exe concealment utility. A retrospective hunt tied one ScreenConnect configuration to 22 additional endpoints across separate incidents.
- Public Power BI dashboards host malicious links trusted by email security controls.
- Browser fingerprinting and delays filtered analysts before serving the ScreenConnect installer.
- PowerShell task installed a second ScreenConnect client and removed the first for evasion.
- Telegram bot API exfiltrated victim IP, geolocation, and download telemetry.
- One ScreenConnect configuration linked to 22 additional endpoints across separate incidents.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious LinkT1219 Remote Access SoftwareT1053.005 Scheduled Task
- Organizations
- MicrosoftHuntressConnectWise ScreenConnect
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | app.powerbi.com | il containing a link to a fake reference document hosted on app.powerbi.com . Huntress could not recover the original message or its pr |
| domain | burnsworth.site | roject[.]site/S/ . Other observed delivery domains included burnsworth[.]site , essaywritingservice[.]site , and openpediatrics[.]site |
| domain | dailylifeproject.site | URLs. Power BI Phishing Clicking the download button opened dailylifeproject[.]site/S/ . Other observed delivery domains included burnsworth[ |
| domain | essaywritingservice.site | ther observed delivery domains included burnsworth[.]site , essaywritingservice[.]site , and openpediatrics[.]site . These pages inspected brows |
| domain | hamham27.screenconnect.com | er, not a reference document. The installer originated from hamham27[.]screenconnect[.]com . Campaign variants reused that tenant and installer pa |
| domain | instance-g01s1n-relay.screenconnect.com | first unauthorized client, 2b302081e9e777d0 , connected to instance-g01s1n-relay[.]screenconnect[.]com and established a second client, 43773b3da4ccb17b , ass |
| domain | onthegotree.site | blished a second client, 43773b3da4ccb17b , associated with onthegotree[.]site . In one incident, LyN03DvVjUKPrun.cmd launched SCAutoFix |
| domain | openpediatrics.site | cluded burnsworth[.]site , essaywritingservice[.]site , and openpediatrics[.]site . These pages inspected browser versions, operating syste |
| domain | vykyn.click | ivery. Visitors failing the checks were redirected to check.vykyn[.]click/E/ . The landing pages also embedded a Telegram Bot API c |
| sha256 | 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 | ScreenConnect.ClientService.exe (2b302081e9e777d0) SHA256: 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 Initial rogue ScreenConnect client ScreenConnect.ClientServ |
| sha256 | f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 | ScreenConnect.ClientService.exe (43773b3da4ccb17b) SHA256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 Secondary rogue ScreenConnect client SCAutoRepairEvery2Min |
From the original article
3 min read at gbhackers.com
Attackers abused Microsoft Power BI to deliver unauthorized ScreenConnect remote monitoring and management (RMM) clients, using trusted Microsoft infrastructure to disguise phishing links and establish persistent access. Huntress observed the campaign beginning September 10, 2026, across several endpoints.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.