Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

Attackers abused legitimate Microsoft Power BI dashboards to host a fake reference document that redirected users to attacker-controlled landing pages which fingerprinted the environment, reported telemetry to a Telegram bot, and automatically downloaded malicious ScreenConnect RMM installers; multiple rogue RMM instances were deployed (with tenant reuse and guest tokens), persistence and defense-evasion techniques were observed (scheduled tasks, PowerShell scripts, HideUL_x64.exe), and the report includes IOCs and detection/mitigation recommendations.