Hackers abused Microsoft Power BI dashboards for phishing

Huntress uncovered a campaign that began around September 10, 2026, in which attackers created public Power BI dashboards disguised as blurred documents with a "Download Reference" button. Clicking it redirected victims to attacker-controlled sites that auto-downloaded ScreenConnect, giving persistent remote access to corporate networks.

• Campaign started on or around September 10, 2026
• Dashboard mimicked a blurred document with a "Download Reference" button
• Click redirected to attacker sites that auto-downloaded ScreenConnect
• In some cases two ScreenConnect instances and a PowerShell task were deployed