Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access

What happened

Huntress observed the campaign beginning September 10, 2026, across several endpoints. The operation combined public dashboard lures, browser fingerprinting, delayed executable downloads, and redundant remote access installations.

The intrusion began with an Outlook phishing (messages that impersonate someone to obtain passwords or money) email containing a link to a fake reference document hosted on app.powerbi.com . Attackers abused Microsoft Power BI to deliver unauthorized ScreenConnect remote monitoring and management (RMM) clients, using trusted Microsoft infrastructure to disguise phishing links and establish persistent access. Microsoft is a software and software development company based in Redmond.

A retrospective hunt linked one distinctive ScreenConnect client configuration to 22 additional endpoints across separate incidents, rather […] The post Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . cyber security Cyber Security News Phishing 3 min.

Read Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access By Mayura Kathir October 12, 2026 Share Facebook Twitter Pinterest WhatsApp Attackers abused Microsoft Power BI to deliver unauthorized ScreenConnect remote monitoring and management (RMM) clients, using trusted Microsoft infrastructure to disguise phishing links and establish persistent access. A retrospective hunt linked one distinctive ScreenConnect client configuration to 22 additional endpoints across separate incidents, rather than confirming all belonged to this phishing campaign.