Hackers abuse Microsoft Power BI to deliver ScreenConnect in phishing attacks

How the attack unfolded

According to TechRadar, attackers created public Microsoft Power BI dashboards designed to appear as blurred documents. These dashboards included a button labeled "Download Reference," which redirected victims to an attacker-controlled website outside Microsoft’s infrastructure.

The website automatically downloaded ScreenConnect, a remote access tool developed by ConnectWise, onto the victim’s device. ScreenConnect is a legitimate software used for remote support and management, but in this case, it was repurposed to establish persistent remote access for the attackers.

The campaign began on or around September 10, 2026. Huntress, the cybersecurity firm that detected the attack, reported that the attackers used either a throwaway or compromised Microsoft account to host the malicious dashboards.

Persistent access and potential motives

Once installed, ScreenConnect connected to an attacker-controlled endpoint, providing the threat actors with remote access to the victim’s system. The attackers then deployed a second instance of ScreenConnect and configured a scheduled task to repeatedly execute a PowerShell script, ensuring persistent access.

In at least one incident, the attackers deleted the first instance of ScreenConnect after deploying the second, possibly to obscure their tracks or reduce detection risk.

Huntress intercepted the attack before its ultimate goal could be determined. However, the security firm noted that the attackers could have used their access for ransomware, espionage, data theft, or other financially motivated activities. The durable foothold established in corporate networks suggests a high level of sophistication.

Why Power BI was effective for phishing

The attackers leveraged Power BI’s legitimacy to bypass traditional email filters, which often whitelist Microsoft domains and services. By hosting the phishing content on a trusted platform, the campaign avoided detection until victims interacted with the malicious dashboards.

This tactic highlights a growing trend where attackers abuse business intelligence and collaboration tools to evade security measures. Publicly accessible dashboards, like those used in this campaign, can serve as low-risk, high-reward vectors for phishing.

Broader context of attacks on trusted services

The abuse of trusted services like Microsoft Power BI reflects a broader shift in cyberattack strategies. Attackers increasingly exploit legitimate software and cloud services to bypass security controls, as these platforms often enjoy implicit trust from users and organizations.

Recent examples include the exploitation of AI tools, identity management systems, and remote access software for malicious purposes. For instance, SailPoint’s 2026 product launches address the growing risk of machine-speed identities outnumbering human ones in enterprises, a trend that complicates security monitoring.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This attack is a reminder that legitimate software—especially remote access tools and business intelligence platforms—can become powerful weapons in the hands of threat actors. For founders and operators, the implications are twofold: first, even trusted vendors and services can be vectors for compromise, and second, security teams must look beyond traditional email filtering to detect phishing attempts that leverage whitelisted platforms.

The use of Power BI in this campaign also underscores the importance of scrutinizing publicly shared assets, whether they’re dashboards, documents, or cloud-based collaborations. Phishing is no longer just an email problem; it’s a pervasive risk that requires vigilance across all digital touchpoints. Finally, the attackers’ ability to establish persistent access through ScreenConnect highlights the need for robust endpoint monitoring and rapid incident response to disrupt attacker footholds before they escalate.

Key takeaways

• Legitimate business tools like Power BI and ScreenConnect can be repurposed for malicious campaigns, making detection harder.
• Publicly accessible dashboards or documents on trusted platforms are potential vectors for phishing; review sharing settings and monitor for misuse.
• Remote access tools are high-value targets for attackers seeking persistent access; enforce strict controls and audits for their use.
• Phishing campaigns increasingly bypass traditional email filters by leveraging trusted services; supplement email security with behavioral and endpoint monitoring.
• Incident response teams should prioritize identifying and disrupting attacker persistence mechanisms, such as scheduled tasks or secondary remote access tools.

FAQ

What is Microsoft Power BI, and how was it abused in this attack?

Microsoft Power BI is a business analytics tool used to create and share interactive dashboards and reports. In this attack, hackers created public dashboards that appeared as blurred documents with a download button, tricking victims into clicking and downloading malicious software.

What is ScreenConnect, and why is it significant in this campaign?

ScreenConnect, developed by ConnectWise, is a legitimate remote access tool used for IT support and management. In this campaign, attackers used it to establish persistent remote access to victims' systems, enabling potential follow-on attacks like ransomware or data theft.

How can organizations protect themselves from similar attacks?

Organizations can reduce risk by reviewing sharing settings for public dashboards or documents, monitoring for unusual downloads of remote access tools, enforcing strict controls on scheduled tasks, and supplementing email filters with behavioral and endpoint security measures.

Why did the attackers use two instances of ScreenConnect?

The attackers deployed a second instance of ScreenConnect and configured a scheduled task to execute a PowerShell script, likely to ensure persistent access even if the first instance was detected or removed. In at least one case, they deleted the first instance, possibly to hide their activity.

Related on Lazyfounder

• Microsoft
• More technology news
• SailPoint launches real-time identity security for the agentic era
• Teen bug hunter exposes flaw in Microsoft’s Titan analytics service