Attackers Are Hiding Behind Real Microsoft Power BI Links to Install Remote Access Tools
A phishing campaign uses genuine Microsoft Power BI pages to get past email filters, then quietly installs two copies of a legitimate remote support tool. Here is how it unfolds and which layers stop it.
Here Is How Layered Defenses Help When the Link Looks Legitimate
Most staff are taught to check where a link goes. In this campaign, the link really does go to Microsoft. Attackers are using public Microsoft Power BI pages as phishing landing pages, then using that borrowed trust to install remote support software that gives them a way back into the computer.
Security firm Huntress documented the campaign after its security operations team shut down these intrusions. It first saw the activity on September 10, across a handful of endpoints. A later look back through its data found the same rogue client configuration on 22 more endpoints in separate incidents.
The attack, step by step
- An email arrives. A phishing message in Outlook contains a link to a page on Microsoft’s real Power BI domain, app.powerbi.com. Attackers have previously built genuine dashboards under their own throwaway or compromised accounts, added a malicious link and set sharing to public. Because the address belongs to Microsoft, mail filters and security gateways that trust the domain may let it through.
- A blurred document asks for a click. The Power BI page shows a fuzzy form and a “Download Reference” button.
- A new tab checks out the visitor. The button opens a site the attacker controls. It fingerprints the browser and device (operating system, browser version, screen size, signs of automation and more) and reports details such as IP address and location to the attacker through a Telegram bot. Visitors that look like scanners or researchers are sent elsewhere. One version only served Windows desktops and filtered out Microsoft and unknown internet providers.
- The download starts by itself. After a few seconds, a script clicks a hidden download link. The page tells the victim a “Reference Verification Form” downloaded successfully. The file is actually an installer for ScreenConnect, a legitimate remote support product, tied to an account the attacker controls.
- A second foothold is added. The first rogue client sets up a second one connected to different infrastructure. In one case, a script installed the second client and then removed the first, likely to avoid detection. That way, cleaning up the first one still leaves the attacker inside.
- The tracks are covered. The attackers ran a tool Huntress assessed as designed to hide activity from the user and security software, and in one case created a scheduled task to re-run their repair script every two minutes. Huntress’s team shut the attacks down at this stage.
Nothing in Huntress’s write-up points to a software bug in either product. The campaign abuses Power BI’s public sharing and ScreenConnect’s legitimate remote access features.
The layers that break the chain
No single control catches everything here, which is why layering matters. Each layer below would have stopped or exposed the attack at a different step. Products are named only as examples.
- Email and link protection that inspects the destination, not just the domain. Time-of-click link checking, for example Safe Links in Microsoft Defender for Office 365 or similar features in other secure email gateways, re-evaluates a link when it is clicked instead of trusting the domain alone. Review allow-lists that blanket-trust big cloud domains.
- A habit of reporting, not just deleting. Give users a one-click way to report suspicious messages, and teach that a real Microsoft address can still deliver a fake document, especially one that starts a download.
- Control over what software can run. Application control, such as Windows Defender Application Control or AppLocker, or an allow-listing feature in your endpoint tool, can block installers that users download from the web.
- One approved remote access tool. Choose your sanctioned remote support platform and block or alert on any other copy. That includes the same brand connected to someone else’s account, because a rogue ScreenConnect looks just like your own unless you check which instance it connects to.
- Endpoint detection with people watching it. New remote access installs, scripts launched from temporary folders and scheduled tasks that fire every few minutes are exactly what a monitored EDR or managed detection service should flag.
- Least privilege on the desktop. Staff without local admin rights make silent installs and persistence much harder.
- Thorough cleanup. If you find one rogue remote access client, look for a second, plus any scheduled tasks or scripts that reinstall it, before you call the machine clean.
What this means for your company
Attackers no longer need suspicious-looking domains or custom malware. A trusted cloud page and a legitimate IT tool can get them in. For small and mid-size businesses that live in Microsoft 365, the takeaway is to stop treating “it’s a Microsoft link” as proof of safety and to know exactly which remote access software belongs on your computers. If you work with an IT provider, ask which remote support tool they use, how they would spot an unapproved one, and how quickly they would be alerted.
Need help making sure the only remote access tools on your company’s computers are the ones you approved? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
