Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress, Wednesday, October 7th, 2026
Huntress details a phishing campaign that uses legitimate Microsoft Power BI links to deliver rogue ScreenConnect RMM clients.
Huntress tracked a phishing campaign, active since September 10, in which Outlook emails linked to a fake reference document hosted on a legitimate Microsoft Power BI domain.
Because the link points to Microsoft's real domain, it can slip past Microsoft 365 mail filters and other gateways, and clicking Download Reference opened a fingerprinting landing page that delivered multiple malicious ScreenConnect remote monitoring and management instances.
A retroactive hunt found the same ScreenConnect client and configuration on 22 other endpoints across separate incidents.