A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.
The operation uses a fake reference document hosted on Microsoft’s real service, making the opening link appear safe before directing victims to attacker-controlled download pages.
The attack does not depend on a reported Power BI software flaw. Instead, it turns trust in a familiar business platform into a delivery route for remote monitoring and management software, or RMM.
ScreenConnect is legitimate support software, but these installations connect victims to infrastructure controlled by attackers.
Researchers from Huntress identified the campaign starting September 10, 2026, and detailed it in their Power BI phishing report, published October 7.
They observed several affected endpoints. A separate historical hunt found the same unique client and configuration on 22 additional endpoints across separate incidents, not necessarily this exact campaign.
Microsoft Power BI Phishing Campaign
The chain began with an Outlook phishing email, although Huntress could not recover the original message. Its link opened a blurred reference form on Power BI with a “Download Reference” button.
Huntress explains that attackers have previously created public Power BI dashboards through accounts they control, including compromised or disposable accounts, and embedded malicious links inside them.
Since the first address belongs to Microsoft, security gateways that trust the domain may let the message through. The danger appears after the user follows the fake reference download prompt.
Clicking the button opened an attacker-controlled page that checked the visitor’s operating system, browser version, screen size, user-agent, automation signs, and other details.
.webp)
It sent IP addresses, location, browser information, and download activity to a Telegram bot. Visitors who failed the checks were redirected elsewhere.
One variant accepted Windows desktop systems while filtering Microsoft or unknown internet service providers. These checks helped screen out scanners and researchers.
After a short delay, JavaScript activated a hidden download link, then displayed a message claiming the reference verification form had downloaded successfully. Downloading the installer alone was not evidence of execution.
Two Clients Extend Remote Access
The initial installer came from a ScreenConnect tenant reused across variants, with different guest-access parameters. It established one rogue client connected to a ScreenConnect relay, which then installed another client linked to separate attacker infrastructure.
The script downloaded and executed the second installer, then removed the first ScreenConnect instance. Huntress assessed that removal as a likely attempt to avoid detection.
Attackers also executed a tool Huntress assessed as designed to hide their activity from users and security software. In one case, a scheduled task ran the repair script every two minutes before the security operations center stopped the attack.
Multiple clients can leave another access route after defenders remove one. The report does not name a threat group or establish that data was stolen. Its findings describe the delivery chain and persistent access, rather than a confirmed ransomware event.
For defenders, the important distinction is ownership: a real remote support application becomes dangerous when an unknown party controls its connection and installs it through a misleading document request.
Huntress recommends reviewing phishing controls for trusted cloud links, monitoring unexpected ScreenConnect installations, and restricting remote tools to approved instances.
Teams should investigate multiple RMM clients, unusual scripts, and new scheduled tasks. Connecting downloads, execution, and outbound traffic, as explained in detecting trusted tool abuse, helps distinguish authorized support from attacker access.
Indicators of compromise (IoCs)
| Type | Indicator | Role |
|---|---|---|
| SHA-256 | 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3 |
Initial client |
| SHA-256 | f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 |
Secondary client |
| Client ID | 2b302081e9e777d0 |
Initial instance |
| Client ID | 43773b3da4ccb17b |
Secondary instance |
| Filename | ScreenConnect.ClientService.exe |
Both clients |
| Filename | ScreenConnect.ClientSetup.exe |
Initial installer |
| Filename | LyN03DvVjUKPrun.cmd |
Command file |
| Script | SCAutoFix.ps1 |
Repair script |
| Task | SCAutoRepairEvery2Min |
Two-minute execution |
| Filename | HideUL_x64.exe |
Evasion tool |
| URL | hxxps[://]app[.]powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 |
Reference lure |
| URL | hxxps[://]dailylifeproject[.]site/S/ |
Staging page |
| URL | hxxps[://]burnsworth[.]site/S/main.html |
Staging variant |
| URL | hxxps[://]essaywritingservice[.]site/S/main[.]html |
Staging variant |
| URL | hxxps[://]openpediatrics[.]site/S/main.html |
Staging variant |
| Redirect | check.vykyn[.]click/E/ |
Failed checks |
| URL | hxxps[://]hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN |
Installer download |
| URL | hxxps[://]hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO |
Installer variant |
| URL | hxxps[://]hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE |
Installer variant |
| Domain | instance-g01s1n-relay[.]screenconnect[.]com |
Initial relay |
| Domain | onthegotree[.]site |
Secondary infrastructure |
| URL | hxxps[://]onthegotree[.]site/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest |
Secondary installer |
| Path | C:\Temp\ScreenConnect.ClientSetup.msi |
Installer path |
| Path | C:\Users\ScreenConnect.ClientSetup (6).exe |
Reported saved path |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.