Threat Intel

Power BI phishing campaign drops rogue ScreenConnect clients

A phishing campaign abuses Microsoft Power BI's trusted domain to host lures that evade email gateways, then drops multiple ScreenConnect clients for persistent remote access — a technique that weaponises legitimate SaaS trust.

Summary written by editorial AI · Source link below

Filed by IT Security Guru7 October 20261 min readRead at source ↗

Attackers are abusing Microsoft Power BI to host phishing lures that slip past email security, before dropping multiple rogue ScreenConnect clients on victims’ machines to secure persistent remote access, according to new research from Huntress. The campaign, first observed on 10 September, uses public Power BI dashboards on Microsoft’s legitimate app.powerbi.com domain as the landing […] The post Power BI phishing campaign drops rogue ScreenConnect clients appeared first on IT Security Guru .

Editorial Analysis

Why it matters

Abusing trusted SaaS platforms for phishing delivery neutralises domain-reputation defences, meaning organisations need behavioural detection layers beyond URL filtering.

What to do

Block or alert on unauthorised remote-access tool installations (especially ScreenConnect) and add Power BI external sharing URLs to your email security inspection policies.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at IT Security Guru

External link — opens at IT Security Guru in a new tab.

Continue with

Editorial Analysis

More from the Threat Intel Desk