Hackers Use Microsoft Power BI Dashboards to Spread ScreenConnect Phishing Campaign

Power BI is Microsoft's business intelligence and data visualization platform. It allows users to create charts, reports, and dashboards from spreadsheets, databases, cloud services, and other sources, and to publish reports and dashboards online or share them privately.

In this campaign, the threat actors created a public dashboard, likely using a throwaway Microsoft account or a compromised one. Huntress did not confirm how the account was obtained. The dashboard was designed to look like a blurred document with a button labeled “Download Reference.”

The blurred document trick is common in phishing emails, and services such as DocuSign, Dropbox, and even Office 365 have been abused in similar ways. Victims are told to click a link to unblur or unlock a document. Sometimes they are asked to download a premium or updated document reader, and sometimes they are asked to log in with Office or Google credentials. In this campaign, clicking the “Download Reference” button redirected the victim to an attacker-controlled website outside Microsoft's infrastructure, where an automatic download of ScreenConnect was launched.

ScreenConnect itself is not malicious. It is a legitimate remote access and support tool developed by ConnectWise for IT staff to manage devices remotely. Users can connect to other devices over the internet, troubleshoot problems, transfer files, and install software. Once installed and connected to an attacker-controlled endpoint, ScreenConnect can provide persistent remote access.

The researchers did not discuss how the emails were delivered. Because the messages contained a link to a legitimate Microsoft service, they most likely evaded at least some email filters and reached people's inboxes. That is probably why Power BI was used, aside from the fact that it is not commonly abused in this way.

After deploying one ScreenConnect instance, the attackers deployed a second one and configured a scheduled task to repeatedly execute a PowerShell script. In at least one incident, they also deleted the first instance. Why they did this remains unknown. A possible explanation is that they were trying to establish reliable, persistent remote access while making their activities harder to detect and disrupt. If defenders discovered and removed one malicious ScreenConnect installation, a second one might remain available.

Because Huntress stopped the observed attack before it moved beyond establishing remote access, it is not known whether the goal was to steal data, deploy ransomware, or engage in financial fraud. With two ScreenConnect installations, the attackers were able to establish a durable foothold inside corporate networks that could subsequently be used for espionage, data theft, ransomware, or other financially motivated attacks.

As a general defense measure, researchers advised being highly skeptical of incoming emails, especially those with links to locked documents, and even more so those that result in a ScreenConnect deployment.