Home / Technology / Attackers Use Microsoft Dashboards for Phishing
Attackers Use Microsoft Dashboards for Phishing
12 Oct
Summary
- Attackers used Microsoft Power BI dashboards to lure victims into downloading ScreenConnect.
- Public dashboards mimicked blurred documents, redirecting users to malicious sites.
- The campaign aimed to establish persistent remote access for potential data theft.
Cybercriminals are now abusing Microsoft Power BI, a popular business intelligence platform, to distribute malicious software. Researchers discovered a campaign initiated around September 10, 2026, where attackers created public Power BI dashboards designed to resemble blurred documents.
These dashboards featured a 'Download Reference' button, which, when clicked, redirected unsuspecting victims to an attacker-controlled website. This site automatically triggered the download of ScreenConnect, a legitimate remote monitoring and management tool. The attackers then deployed multiple ScreenConnect instances and configured scheduled tasks to ensure persistent remote access.
While the ultimate goal remains unknown, this persistent access could be leveraged for various nefarious activities, including espionage, data theft, or ransomware deployment. Security experts advise extreme caution with emails containing links to documents, especially those prompting software downloads.
