- Attackers abused Microsoft Energy BI dashboards to lure victims into downloading ScreenConnect software program
- Public dashboards mimicked blurred paperwork and redirected customers to attacker-controlled websites
- Marketing campaign established persistent distant entry, probably enabling ransomware, espionage, or knowledge theft
Microsoft’s Energy BI has seemingly change into the most recent in an ever-growing line of reliable software program being abused in phishing assaults.
Safety researchers Huntress mentioned they uncovered a brand new marketing campaign that leverages publicly accessible Energy BI dashboards to trick individuals into downloading distant monitoring and administration software program (RMM) known as ScreenConnect. The top sport of the marketing campaign just isn’t recognized at the moment.
Energy BI
Energy BI is Microsoft’s enterprise intelligence and knowledge visualization platform, permitting customers to create charts, reviews, and varied dashboards, out of their knowledge and different uncooked info. The instrument itself can accumulate knowledge from sources resembling spreadsheets, databases, cloud companies, and extra, and customers can publish reviews and dashboards on-line, or share them with colleagues privately.
Newest Movies FromTechRadar
On this marketing campaign, which began on or round September 10 2026, the risk actors created a public dashboard, possible utilizing a throwaway Microsoft account (or a compromised one). Huntress doesn’t verify how that account was obtained, however says that the dashboard was designed to appear like a blurred doc with a button labeled “Obtain Reference”.
The blurred doc trick is quite widespread in phishing emails. Different companies resembling DocuSign, Dropbox, and even Workplace 365, have been being abused in the identical means. To “unblur” (or unlock) the doc, victims are advised to click on a hyperlink and observe alongside.
Generally they have been requested to obtain a “premium” model of a doc reader, or an “up to date” one, and generally they have been requested to log in utilizing their Workplace or Google credentials. This assault is not any completely different – clicking on the “Obtain Reference” button redirects the sufferer to an attacker-controlled web site outdoors Microsoft’s infrastructure, the place an computerized obtain of ScreenConnect is launched.
By itself, ScreenConnect just isn’t malicious. It’s a reliable distant entry and help instrument developed by ConnectWise, and designed to assist IT workers handle units remotely. By means of the product, customers can join different units on the web, troubleshoot issues, switch recordsdata, and set up software program. As soon as put in and linked to an attacker-controlled endpoint, ScreenConnect can present persistent distant entry.
Establishing persistence
The researchers didn’t talk about how the emails have been delivered, however since they contained a hyperlink to a reliable Microsoft service, they most definitely evaded at the very least some electronic mail filters and landed in individuals’s inboxes. In any case, that is in all probability why Energy BI was used within the first place (except for the truth that it’s not generally abused this manner).
However what’s significantly attention-grabbing about this assault is that after deploying one ScreenConnect occasion, the attackers deployed a second one and configured a scheduled activity to repeatedly execute a PowerShell script. In at the very least one incident, in addition they deleted the primary occasion.
Why they did it stays a thriller. An informed guess could be that they have been attempting to determine dependable, persistent distant entry, whereas on the identical time ensuring their actions have been tougher to detect and disrupt. If defenders have been to find and take away one malicious ScreenConnect set up, a second one may stay out there.
That is all within the area of hypothesis, sadly, since Huntress stopped the noticed assault earlier than it progressed past establishing distant entry. Due to this fact, we don’t know if the objective was to steal knowledge, deploy ransomware, or have interaction in monetary fraud. What we do know is that with two ScreenConnects, they have been capable of set up a sturdy foothold inside company networks, which they may subsequently leverage for espionage, knowledge theft, ransomware, or different financially motivated assaults.
As a normal rule of thumb, the easiest way to defend in opposition to some of these assaults is to be extremely skeptical of incoming emails, particularly these with hyperlinks to “locked” paperwork, and much more so people who find yourself with a ScreenConnect deployment.
The very best antivirus for all budgets
Comply with TechRadar on Google Information and add us as a most well-liked supply to get our skilled information, evaluations, and opinion in your feeds.
