The campaign began around September 10 and installed remote access software on victims' computers.

 

What happened

Attackers have been using public Microsoft Power BI dashboards to trick people into installing remote access software, TechRadar reported on October 12, 2026, citing researchers who uncovered the campaign. Power BI is Microsoft's tool for building charts, reports, and dashboards from business data. Users can publish dashboards publicly on the web. The campaign started on or around September 10. Researchers say the phishing emails most likely got past at least some email filters because they linked to a genuine Microsoft service. How the emails were delivered hasn't been disclosed.

 

Going deeper

The dashboard was built to look like a blurred document with a button labeled "Download Reference." Blurred documents are a common lure. They tell the recipient the file is locked until they click. Here, the button sent the victim to a site the attackers controlled, outside Microsoft's systems. That site started an automatic download of ScreenConnect. ScreenConnect is a legitimate remote support software made by ConnectWise. IT teams use it to manage computers from a distance. Once it's installed and connected to an attacker's server, it gives them ongoing remote access to the machine. Researchers don't know whether the attackers created a new Microsoft account for the dashboard or used a compromised one.

 

What was said

Researchers stopped the observed attack before it moved past gaining remote access, TechRadar reported. They don't know whether the goal was data theft, ransomware, or financial fraud. After installing one copy of ScreenConnect, the attackers installed a second. They then set a scheduled task to run a PowerShell script repeatedly. PowerShell is a Windows tool for running commands and automating tasks. In at least one case, they deleted the first copy.

 

In the know

Installing a second remote tool as a backup has shown up in other campaigns this year. Microsoft documented attackers in July using one remote management product to download and install ScreenConnect as a second, separate channel, in research published September 29. If defenders find and remove one installation, the other keeps working. Microsoft also found that installations failed when the user declined the Windows prompt asking for permission to make changes. They succeeded when the user approved it.

 

The big picture

Healthcare staff open shared document links constantly, from referrals to vendor invoices, and that habit is what this campaign relies on. Phishing accounted for 14% of the ways attackers got into healthcare organizations in Verizon's latest data, and the human element was present in 54% of healthcare breaches, according to its 2026 healthcare snapshot. Microsoft lets organizations control who can publish Power BI content publicly. Administrators can switch "Publish to web" off, or limit it to specific security groups, according to Microsoft's documentation. That setting doesn't stop an outside attacker using their own account, but it does stop a compromised staff account from being used to host lures on the organization's own tenant. A health system that doesn't publish dashboards publicly has little reason to leave the option open.

 

FAQs

Why use Power BI rather than a fake website?

A link to a Microsoft domain looks trustworthy to both people and email filters. A newly registered fake domain is easier for filters to flag.

 

What should someone do if a document asks them to download software to view it?

Stop and check with the sender through a known phone number or a separate message. Legitimate shared documents rarely need new software installed to open them.

 

Is ScreenConnect itself a security risk?

No. It's a legitimate tool used by IT teams. The risk comes when an attacker installs it and connects it to their own server.

 

How can an organization spot unexpected remote access software?

Keep a list of approved remote access tools and alert on any others that appear. Many organizations find unapproved tools already installed once they check.

 

What does "Publish to web" do?

It creates a public link to a Power BI report that anyone on the internet can view without signing in. Microsoft's documentation describes it as a tenant setting that administrators control.