Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

In September, attackers conducted a phishing campaign abusing Microsoft Power BI domains to host fake reference documents. Victims received emails with embedded links that redirected to these Power BI-hosted pages. When victims clicked 'Download Reference,' they were redirected to attacker-controlled websites that fingerprinted their systems and browsers. This process triggered downloads of malicious ScreenConnect remote monitoring tool installers. The attackers deployed multiple ScreenConnect instances to maintain persistent remote access, including a second client connected to attacker infrastructure. Post-deployment, defense evasion tools were executed and scheduled tasks were created to run persistence scripts every two minutes. The campaign also employed browser fingerprinting and Telegram bots to filter victims and track infections, exploiting trusted Microsoft domains to evade email security controls and enhance attack credibility.

The campaign enables attackers to gain persistent remote access to victim systems by deploying rogue ScreenConnect remote monitoring tools. This access allows execution of defense evasion techniques and continuous persistence via scheduled tasks. The abuse of trusted Microsoft Power BI domains increases the likelihood of successful phishing by bypassing email security controls and enhancing credibility. Victims are at risk of unauthorized remote control and potential further compromise.

No official patch or fix is applicable as this is a phishing campaign abusing legitimate cloud infrastructure. Organizations should educate users about phishing risks, especially regarding unexpected emails with links to download documents. Email security solutions should be tuned to detect and block phishing attempts, even those leveraging trusted domains. Monitoring for unusual ScreenConnect installations and scheduled tasks may help detect compromise. Since the campaign abuses Microsoft Power BI domains, vigilance in verifying URLs and sources before downloading is critical.