Fake Power BI dashboard delivers ScreenConnect in phishing campaign

Attackers used a public Microsoft Power BI dashboard to direct people to a ScreenConnect download in a phishing campaign, according to security researchers at Huntress. The campaign began on or around September 10, 2026, the researchers said.

The dashboard appeared to show a blurred document and included a “Download Reference” button. Clicking it sent victims to a website outside Microsoft’s infrastructure, where ScreenConnect downloaded automatically. Huntress did not confirm how the account used to create the dashboard was obtained; it may have been a disposable or compromised Microsoft account.

ScreenConnect is a legitimate remote access and support tool made by ConnectWise. But once installed and connected to an attacker-controlled endpoint, it can provide persistent remote access. The researchers did not explain how the phishing emails were delivered. Huntress suggested that links to a legitimate Microsoft service may have helped some messages evade email filters.

In one notable part of the campaign, attackers deployed a second ScreenConnect instance and set up a scheduled task to run a PowerShell script repeatedly. In at least one incident, they also deleted the first instance. Huntress did not establish why they did this; the idea that it was meant to make access more persistent or harder to detect is speculation.

Huntress stopped the observed activity after remote access was established. The researchers therefore do not know whether the attackers intended to steal data, deploy ransomware, commit financial fraud, or pursue another goal. They said the two installations gave the attackers a foothold that could later support espionage, data theft, ransomware, or other financially motivated attacks.