A Huntress report details a phishing campaign abusing legitimate Microsoft Power BI hosting to distribute rogue ScreenConnect installations.
The attack relies on an Outlook email leading to a staging page that filters visitors and logs metrics to a Telegram bot before deploying persistent remote access tools.
How to set the trap
The process begins with an email containing a link. The link leads to a real Microsoft address, which hosts a fake document page. Because the address belongs to a trusted service, security systems usually do not block it.
On this page, the user sees a download button for a supposedly reference document. When someone clicks on it, they are taken to a separate website controlled by the perpetrators. There, the system checks the visitor’s details, such as the operating system, browser, and website address, to exclude any researchers or automated checking systems.
Installing the program
If the computer is deemed suitable, the page starts downloading a remote administration program. This program is normally legitimate software used for technical support, but in this case it has been configured to connect to servers controlled by the perpetrators, giving them access to the computer.
According to security researchers, the process involves installing programs that create communication channels. In some cases, a second program is installed and then the first is removed, likely to make the attack harder for security systems to detect. It also uses a tool designed to hide the activity, which runs automatically at regular intervals.
What do we know so far?
Security researchers spotted the activity starting in September 2026 and released details in October. So far, the investigation has focused on gaining and maintaining access to affected computers, with no evidence to confirm that the attack resulted in data theft.
Top comments (0)