Attackers Abuse Microsoft Power BI Dashboards to Distribute ScreenConnect RMM
Huntress researchers found a campaign using public Power BI dashboards to trick users into downloading remote management software.
Key points
- Huntress identified a phishing campaign starting around September 10, 2026, using Microsoft Power BI.
- Public dashboards mimicked blurred documents with a "Download Reference" button that redirected victims.
- Clicking the button triggered an automatic download of ScreenConnect remote monitoring and management software.
Security researchers at Huntress uncovered a new threat campaign that leverages publicly accessible Microsoft Power BI dashboards to distribute ScreenConnect software. The attack aims to establish persistent remote access on victim devices. According to TechRadar, the end goal of this operation remains unknown, but it could enable ransomware deployment, espionage, or data theft.
How it unfolded
- Threat actors created public dashboards on Microsoft Power BI around September 10, 2026, likely using compromised or throwaway accounts.
- These dashboards were designed to look like blurred documents, featuring a prominent button labeled "Download Reference" to entice interaction.
- Clicking the button redirected users to attacker-controlled websites outside Microsoft’s infrastructure, triggering an automatic download of ScreenConnect.
Who is affected
Microsoft Power BI users who access public dashboards are at risk, particularly those who encounter links mimicking blurred documents. The campaign targets individuals who trust the Microsoft domain, as the dashboards appear legitimate. ScreenConnect itself is a legitimate remote access tool developed by ConnectWise, intended for IT support. However, in this context, it serves as a vehicle for unauthorized remote control, allowing attackers to troubleshoot, transfer files, or install software on compromised devices.
The fix
No patch or specific update has been confirmed by Microsoft to address this abuse of Power BI functionality. Huntress notes that the dashboards were public, meaning any user with the link could access them. Because ScreenConnect is legitimate software, standard antivirus definitions may not flag the download immediately. Organizations should monitor for unexpected remote access sessions and investigate any unsolicited downloads of remote monitoring tools.
What to do and how to stay safe: Microsoft Power BI
- Monitor network traffic for unexpected outbound connections to unknown remote management domains.
- Verify the legitimacy of any document download prompts, especially those requiring software installation to view content.
- Review Power BI sharing settings to ensure sensitive dashboards are not publicly accessible.
- Audit installed applications for unauthorized remote monitoring tools like ScreenConnect.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is ScreenConnect malware?
No, ScreenConnect is a legitimate remote support tool by ConnectWise, but attackers are using it to gain unauthorized access.
How did attackers create the phishing dashboards?
Huntress believes attackers used throwaway or compromised Microsoft accounts to publish the malicious public dashboards.
When did this campaign start?
The campaign began on or around September 10, 2026, according to Huntress researchers.
