Power BI phishing lures install rogue ScreenConnect via hamham27 tenant
Huntress found a phishing campaign, active since September 10, that hides lures on Microsoft's Power BI site and installs rogue ScreenConnect remote-access clients from the hamham27 tenant.
- First reported
- Reports
- 1
Source: thecyberdef.com · published
What happened
The Cyber Def reported on October 13, 2026 on Huntress research into a phishing campaign active since September 10. It starts with an Outlook phishing email whose link opens a fake reference document on app.powerbi.com, Microsoft's legitimate Power BI address. Microsoft's service was abused; Microsoft was not involved.
Huntress's SOC shut down the intrusion it investigated. A later hunt found the same rogue client configuration on 22 other endpoints in separate incidents.
How the scam works
Attackers create a public Power BI dashboard showing a blurred form and a "Download Reference" button. Because the link is on a Microsoft domain, email filters often let it through. The button opens an attacker site (dailylifeproject.site, burnsworth.site, essaywritingservice.site or openpediatrics.site) that fingerprints the visitor, reports details to the attackers through Telegram, and sends scanners to check.vykyn.click.
Visitors who pass see a "Reference Verification Form" message while a hidden link downloads ScreenConnect.ClientSetup.exe from hamham27.screenconnect.com. That rogue client connects to instance-g01s1n-relay.screenconnect.com and installs a second client tied to onthegotree.site, then the attackers ran a defence-evasion tool and a scheduled task (SCAutoRepairEvery2Min) to keep access.
Source
The Cyber Def, "Power BI phishing campaign delivers rogue ScreenConnect RMMs to evade email security" (October 13, 2026), reporting Huntress research.
Red flags
- A shared business document that only offers a "Download" button and a blurred preview.
- A download that starts on its own after a "verification" message.
- ScreenConnect or other remote-access software you did not request appearing on your computer.
If you were targeted
- 1Do not open downloads from unexpected shared documents, even on Microsoft or other trusted domains.
- 2If ScreenConnect.ClientSetup.exe ran, disconnect the computer from the network and contact your IT or security team.
- 3IT teams: block unapproved ScreenConnect instances, look for scheduled tasks or scripts tied to remote-access tools, and investigate any machine running more than one remote-management client.
- 4Change passwords from a clean device if remote access was established.