Hackers hide behind Microsoft's own websites to get past email filters and launch phishing campaigns

Attackers have been exploiting Microsoft's Power BI dashboards to evade email filters and launch phishing campaigns, aiming to distribute ScreenConnect remote monitoring and management software. Power BI, a business intelligence and data visualization platform, allows users to create charts, reports, and dashboards from data sources like spreadsheets, databases, and cloud services.

The threat actors created public dashboards, likely using compromised accounts, that mimicked blurred documents and redirected victims to attacker-controlled websites. Clicking the "Download Reference" button led to the automatic download of ScreenConnect, providing the attackers with persistent remote access. Some researchers speculate that the attackers may have deployed a second instance of ScreenConnect to ensure reliable access and evade detection, potentially using it for data theft, ransomware deployment, or other financially motivated attacks.

To protect against such attacks, users should remain vigilant when opening emails containing links to "locked" documents and suspicious attachments.