PhishingReviewed
Power BI phishing lures install rogue ScreenConnect via hamham27 tenant
Huntress found a phishing campaign, active since September 10, that hides lures on Microsoft's Power BI site and installs rogue ScreenConnect remote-access clients from the hamham27 tenant.
- hamham27.screenconnect.com
- Also: onthegotree.site, instance-g01s1n-relay.screenconnect.com
Reported Oct 13, 20261 report