Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients

This report details a Power BI-based phishing campaign that bypassed email filters by hosting a malicious "Download Reference" on Microsoft domains; the attack fingerprinted visitors, delayed a hidden ScreenConnect installer download, deployed two remote-access clients for redundancy, used a Telegram bot for telemetry/C2, and employed scheduled tasks and defense-evasion scripts to persist on a small set of compromised Windows endpoints. Huntress and Microsoft observed the activity, and recommended restricting RMM instances, alerting on new ScreenConnect installs, investigating multiple RMM clients on hosts, monitoring scheduled tasks tied to remote-access scripts, and training users to report suspicious trusted-looking links.