Power BI phishing (Huntress, 7 Oct): public Microsoft Power BI reports used as lures to push two stacked rogue ScreenConnect clients for persistent remote access; no Power BI flaw involved
Huntress said on 7 October 2026 that since 10 September it has seen a phishing campaign that hosts its lure on Microsoft's real Power BI service so the first link gets past mail filters that trust the domain. Outlook phishing emails linked to a public report on app.powerbi.com showing a blurred form and a 'Download Reference' button. Huntress says attackers build these by publishing a dashboard from an account they control, often compromised or disposable, and sharing it publicly. No Power BI software flaw is involved. The button opened attacker pages (for example dailylifeproject[.]site and burnsworth[.]site) that fingerprinted the visitor (operating system, browser, screen size, automation signs, ISP and location), sent the details to a Telegram bot, allowed only Windows desktops and filtered out Microsoft or unknown ISPs, and redirected failures elsewhere. After a few seconds a script clicked a hidden link to download ScreenConnect.ClientSetup.exe from one attacker ScreenConnect tenant, with a different guest-access token for each lure. That first rogue client then installed a second ScreenConnect client tied to separate infrastructure (onthegotree[.]site), so removing one left access in place. In one incident a CMD file ran SCAutoFix.ps1 to install the second client and remove the first, the attackers ran a defence-evasion tool (HideUL_x64.exe), and a scheduled task, SCAutoRepairEvery2Min, re-ran the script every two minutes. Huntress saw a handful of endpoints hit by this delivery chain, and a retrospective hunt found the same unique ScreenConnect client and configuration on 22 more endpoints in separate incidents. Huntress says its SOC stopped the activity before it went further. Separate from the MSP360 and CSuite RMM phishing campaigns already on this desk. Primary: Huntress (7 Oct); wire: Cybersecurity News (12 Oct).
- Product
- Microsoft Power BI (abused as a trusted lure host) + ConnectWise ScreenConnect (abused legitimate RMM)
- Versions
- n/a — phishing and legitimate-tool abuse, not a product CVE
- Exploited in Australia?
- unknown
- Patch to
- Do not allow-list links just because they resolve to app.powerbi.com or other Microsoft domains; inspect where they lead. Power BI admins: keep the 'Publish to web' tenant setting restricted so a compromised account in your own tenant cannot be used to host public lures. Endpoint and SOC teams: allow only your organisation's approved ScreenConnect instances and relay hosts, alert on new ScreenConnect client installs from user download folders, and investigate any device running two or more RMM clients or talking to more than one relay. Hunt for scheduled tasks such as SCAutoRepairEvery2Min, SCAutoFix.ps1 and HideUL_x64.exe, and block the Huntress-listed domains.
Primary: Huntress — Phishing campaign abuses Microsoft Power BI to deploy rogue RMMs (Sarah Reddish, 7 Oct 2026) · Cybersecurity News — Microsoft Power BI phishing campaign deploys rogue ScreenConnect RMMs (12 Oct 2026)