Published on October 12, 2026
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Severity
High
Detail
Researchers at Huntress have identified a phishing campaign that abuses Microsoft Power BI to deliver rogue ScreenConnect remote monitoring and management (RMM) software, providing attackers with persistent remote access to compromised Windows systems.
The campaign begins with phishing emails containing links to attacker-controlled content hosted on the legitimate Microsoft Power BI platform. Victims are presented with a fake reference document and prompted to download a file. Following the download process, attackers deploy unauthorized ScreenConnect clients that establish remote access channels to attacker-controlled infrastructure.
Researchers observed that the campaign utilizes multiple stages to evade detection, including victim profiling, anti-analysis checks, and the deployment of secondary remote access clients. In some cases, attackers used scheduled tasks and PowerShell scripts to maintain persistence and restore remote access if components were removed. While no specific threat actor has been attributed to the activity and no data theft has been confirmed, the campaign demonstrates the growing abuse of legitimate cloud services and remote administration tools to establish unauthorized access within targeted environments.
How?
The attack begins with a phishing email that directs victims to a malicious reference document hosted on the legitimate Microsoft Power BI platform. When users click the embedded download button, they are redirected to attacker-controlled websites that perform system profiling, including checks on the operating system, browser, screen resolution, IP address, and other environmental characteristics.
If the victim meets the attacker’s criteria, a rogue ScreenConnect installer is downloaded and executed. The initial client connects to attacker-controlled infrastructure and subsequently deploys a secondary ScreenConnect client to establish additional persistence. Attackers also leverage PowerShell scripts, scheduled tasks, and evasion tools to maintain ongoing access and reduce the likelihood of detection or remediation.
Indicator of Compromises (IoCs)
| Type | Indicator | Description |
| SHA-256 | 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 | Initial client |
| SHA-256 | f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 | Secondary client |
| Client ID | 2b302081e9e777d0 | Initial instance |
| Client ID | 43773b3da4ccb17b | Secondary instance |
| Filename | ScreenConnect.ClientService.exe | Both clients |
| URL | hxxps[://]app[.]powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 | Reference lure |
| URL | hxxps[://]dailylifeproject[.]site/S/ | Staging page |
| URL | hxxps[://]burnsworth[.]site/S/main.html | Staging variant |
Conclusion
This campaign highlights how threat actors continue to abuse trusted cloud platforms and legitimate remote management software to bypass traditional security controls and gain persistent access to corporate environments. Because the initial phishing lure originates from a trusted Microsoft domain, users and email security controls may be more likely to trust the content.
Organizations should strengthen phishing awareness programs, monitor for unauthorized ScreenConnect installations, restrict the use of remote administration tools to approved instances, and investigate suspicious scheduled tasks, PowerShell activity, and remote access software deployments. Security teams should also review controls for trusted cloud-hosted links and monitor network communications associated with known malicious infrastructure.
Source