Hackers exploit Microsoft Power BI to bypass email filters and launch phishing campaigns

Security researchers at Huntress have identified a sophisticated phishing campaign that leverages legitimate Microsoft Power BI dashboards to bypass email security filters. Attackers are creating public dashboards designed to mimic blurred documents, prompting users to click a "Download Reference" button. This action redirects victims to external sites that trigger the installation of ScreenConnect, a legitimate remote monitoring and management tool. By using a trusted Microsoft domain, the attackers successfully evade detection. Once installed, the software provides persistent remote access to corporate networks. The researchers observed the deployment of multiple ScreenConnect instances, suggesting a strategy to maintain a durable foothold for potential espionage, data theft, or ransomware deployment. This incident highlights the growing trend of threat actors abusing trusted cloud services to facilitate malicious activities, making it increasingly difficult for organizations to distinguish between legitimate business communications and sophisticated cyber threats.