Attackers Abuse Microsoft Power BI to Distribute ScreenConnect RMM Clients
Threat actors used trusted Microsoft infrastructure to deliver remote monitoring tools, establishing persistent access through sophisticated phishing lures.
Key points
- Huntress identified the campaign starting September 10, 2026, using Power BI dashboards to host malicious download links.
- Attackers employed browser fingerprinting and telemetry collection via Telegram to filter targets before installing ScreenConnect.
- Retrospective analysis linked one specific client configuration to 22 additional endpoints across separate security incidents.
Threat actors exploited Microsoft Power BI infrastructure to distribute unauthorized ScreenConnect remote monitoring and management clients, according to an investigation by Huntress. The campaign, observed beginning September 10, 2026, leveraged the trusted reputation of Microsoft’s cloud service to bypass email security controls that typically allow URLs hosted on legitimate Microsoft domains.
The intrusion chain initiated with Outlook phishing emails containing links to fake reference documents hosted on app.powerbi.com. Although Huntress could not recover the original messages, the landing pages displayed blurred forms and instructed recipients to click a “Download Reference” button. This action redirected users from the legitimate Microsoft domain to attacker-controlled infrastructure, including domains such as dailylifeproject[.]site and burnsworth[.]site.
Technical Execution and Evasion
The delivery pages performed extensive browser fingerprinting before allowing any downloads to proceed. According to Huntress, the pages inspected browser versions, operating systems, device characteristics, automation indicators, screen dimensions, iframe context, and cloud-provider-associated cookies. Visitors who failed these checks were redirected to check.vykyn[.]click/E/, effectively filtering out scanners and analysis environments.
One variant of the landing page restricted access specifically to Windows desktops while filtering out Microsoft-associated or unknown internet service providers. The pages also embedded a Telegram Bot API credential and chat identifier to transmit victim telemetry. This data included IP addresses, geolocation, browser details, and download activity, allowing attackers to maintain visibility into their targets.
Persistence and Scope
After successful delivery, the operation installed redundant remote access tools to ensure persistent access. Huntress subsequently observed a concealment utility and an automated repair task, demonstrating how legitimate remote administration software can become an attacker’s persistence mechanism. The use of public dashboard lures and delayed executable downloads characterized the technical approach.
A retrospective hunt by Huntress linked one distinctive ScreenConnect client configuration to 22 additional endpoints across separate incidents. However, the firm noted that this link did not confirm all those endpoints belonged to this specific phishing campaign. The operation combined multiple techniques to disguise the malicious activity within trusted Microsoft infrastructure.
What should you do?
Security teams should monitor for unauthorized remote monitoring and management software installations, particularly those originating from unexpected sources. Organizations should review outbound traffic for connections to known attacker infrastructure or unusual Telegram Bot API communications. Administrators should verify that Power BI dashboards published internally do not contain malicious outbound links or unauthorized redirects.
What to do and how to stay safe: Microsoft Power BI
- Inspect endpoint telemetry for unexpected ScreenConnect client installations or configurations that do not match known administrative baselines.
- Review proxy logs for outbound connections to domains associated with the campaign, including dailylifeproject[.]site and essaywritingservice[.]site.
- Audit Microsoft Power BI dashboards for public accessibility and verify that embedded links point to authorized internal or external resources.
- Monitor for browser fingerprinting scripts or redirects to check.vykyn[.]click/E/ in web proxy logs to identify early-stage reconnaissance.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this exploit a vulnerability in Microsoft Power BI software?
No, according to Huntress, the attackers exploited the reputation of a legitimate cloud service rather than a documented Power BI software vulnerability.
How did attackers filter their targets before installing malware?
Attackers used browser fingerprinting to inspect device characteristics and restricted access to Windows desktops while filtering specific internet service providers.
What persistence mechanisms were observed in this campaign?
Huntress observed a concealment utility and an automated repair task, alongside redundant remote access installations of ScreenConnect.
