Power BI phishing campaign drops rogue ScreenConnect clients
A phishing campaign abuses Microsoft Power BI's trusted domain to host lures that evade email gateways, then drops multiple ScreenConnect clients for persistent remote access — a technique that weaponises legitimate SaaS trust.
Summary written by editorial AI · Source link below
Attackers are abusing Microsoft Power BI to host phishing lures that slip past email security, before dropping multiple rogue ScreenConnect clients on victims’ machines to secure persistent remote access, according to new research from Huntress. The campaign, first observed on 10 September, uses public Power BI dashboards on Microsoft’s legitimate app.powerbi.com domain as the landing […] The post Power BI phishing campaign drops rogue ScreenConnect clients appeared first on IT Security Guru .
Editorial Analysis
Abusing trusted SaaS platforms for phishing delivery neutralises domain-reputation defences, meaning organisations need behavioural detection layers beyond URL filtering.
Block or alert on unauthorised remote-access tool installations (especially ScreenConnect) and add Power BI external sharing URLs to your email security inspection policies.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at IT Security Guru in a new tab.
More from the Threat Intel Desk
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers10 Oct
- FBI Arrests Executive at Ransomware Negotiation Firm10 Oct
- Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks9 Oct
- FBI arrests another suspected ShinyHunters hacker after agency breach9 Oct
- P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands9 Oct