Executive Summary
Beginning in September 2026, Huntress observed a phishing campaign leveraging Microsoft Power BI's legitimate 'app.powerbi.com' infrastructure to bypass email security filters. The attackers create public dashboards containing blurred 'reference documents' and a 'Download Reference' button. This campaign is notable for its use of environment fingerprinting and a programmatic delay in payload delivery to evade automated analysis and research scanning.
Technically, the attack chain progresses from the Power BI lure to attacker-controlled staging sites where victim telemetry is exfiltrated via Telegram bots. The payload consists of multiple ScreenConnect clients deployed in tandem to ensure redundant persistence. Attackers were observed using defense evasion tools and scheduled tasks to maintain their foothold even if one instance of the RMM was removed.
This activity represents a significant risk as it exploits the high reputation of Microsoft's cloud ecosystem. Organizations across multiple sectors are targeted, and the reliance on legitimate RMM tools makes detection challenging without granular visibility into authorized remote management software and scheduled system changes.