Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access

Huntress observed a phishing campaign beginning 10 September 2026 that leveraged publicly published Power BI dashboards to host malicious outbound links; victims who clicked a fake “Download Reference” received ScreenConnect RMM installers (multiple tenant/guest configurations) rather than legitimate documents. The pages used browser fingerprinting, delayed and conditional downloads, Telegram-based telemetry exfiltration, and delivered redundant ScreenConnect clients plus a concealment utility and an automated PowerShell repair task (SCAutoRepairEvery2Min) to maintain persistence; Huntress published file names, SHA256 hashes, domains, and remediation guidance to locate and remove all installed clients and persistence mechanisms.