Attackers are hiding phishing links inside Microsoft's own Power BI dashboards to sneak remote-access malware past email filters.
Security firm Huntress found a campaign that began around September 10, 2026, using public Power BI dashboards built to look like blurred documents with a button labeled "Download Reference." Clicking it sent victims to a site outside Microsoft's infrastructure, where ScreenConnect - a legitimate remote-support tool made by ConnectWise - downloaded automatically. In at least one case, the attackers deployed a second ScreenConnect instance alongside a scheduled task that repeatedly ran a PowerShell script, then deleted the first installation. Huntress disrupted the attack before the attackers' end goal became clear, so whether this was headed toward ransomware, espionage, or financial fraud remains unknown.
Using a legitimate Microsoft domain as the delivery vehicle lets these links slip past filters that would otherwise flag an unfamiliar domain - the same trick that has worked before with DocuSign, Dropbox, and Office 365 links. The redundant ScreenConnect installs point to attackers getting more deliberate about surviving a defender's first response, not just getting a foot in the door. That matters beyond this one dashboard: security teams can no longer treat a microsoft.com link as proof an email is safe.
Call it the blurred-document con, running on infrastructure everyone already trusts - which is exactly why it keeps working.