Executive Summary
Huntress has identified a phishing campaign that leverages legitimate Microsoft Power BI infrastructure to steer victims toward malicious remote-access software. By hosting the initial infection link on a public Power BI dashboard, attackers increase the likelihood of bypassing traditional email filters that may trust Microsoft-hosted domains. The campaign, which began around September 10, 2026, primarily targets victims with lures involving fake reference documents.
Technically, the attack chain involves sophisticated evasion techniques including browser fingerprinting and artificial download delays on landing pages to filter automated analysis tools. Once a victim is validated, multiple ScreenConnect clients are installed in sequence; the attackers proactively remove the first client while retaining subsequent ones to ensure redundancy. Persistence is maintained through the creation of scheduled tasks and the use of concealment utilities to hide the presence of the RMM tools.
This campaign is significant because it abuses legitimate RMM software (ScreenConnect), which often blends into normal IT administrative activity. The use of Telegram-bot telemetry provides the attackers with real-time visibility into successful infections outside of their primary hosting infrastructure, making the campaign resilient to single-point takedowns.