Huntress Finds Phishing Attack Abusing Power BI Dashboards
Huntress said attackers hid malicious files behind fake Power BI dashboards, tricking victims into running ScreenConnect and giving remote access.
Huntress has uncovered a phishing campaign that used publicly accessible Microsoft Power BI dashboards as the lure and ScreenConnect as the payload, according to TechRadar. The malicious dashboards were built to resemble a blurred document with a "Download Reference" button, the company said.
Clicking the button did not deliver a file from Microsoft. Instead, it redirected victims to attacker-controlled websites outside Microsoft's infrastructure, where ScreenConnect installed automatically on the victim's machine.
Once remote access was established, the attackers deployed a second ScreenConnect instance and configured a scheduled task to repeatedly run a PowerShell script, according to Huntress. In at least one case they deleted the first instance.
Huntress said it stopped the observed attack before it progressed beyond establishing remote access. The campaign began on or around September 10, 2026, according to the company.
Blurred-document tactic seen before
Abusing trusted cloud services to host or trigger a lure is not new. Services including DocuSign, Dropbox and Office 365 have been used in similar blurred-document phishing attacks, Huntress said.
Quick answers
What was the phishing lure in the Power BI campaign?
A publicly accessible Microsoft Power BI dashboard designed to look like a blurred document with a "Download Reference" button.
What malware did the campaign deliver?
ScreenConnect remote-access software, which downloaded automatically after victims were redirected to attacker-controlled websites.
When did the campaign start?
On or around September 10, 2026, according to Huntress.