Phishing Campaign Uses Power BI to Deliver Rogue ScreenConnect Clients

Summary

Huntress traced a phishing campaign abusing Power BI links to fingerprint targets and install multiple rogue ScreenConnect clients. The tools enabled persistent access; a retroactive hunt linked one client configuration to 22 other endpoints.

Key points

Beginning September 10, Huntress observed phishing emails linking to fake reference documents hosted on legitimate Power BI domains, which could pass checks that trust the service.
A “Download Reference” prompt opened attacker-controlled pages that fingerprinted visitors and sent victim telemetry to a Telegram bot; a delayed hidden link then downloaded a ScreenConnect installer.
The installer deployed two rogue ScreenConnect clients connected to separate infrastructure, providing multiple paths for persistent remote access.
In one incident, a client ran a CMD file that deployed a PowerShell script, installed the second client, and uninstalled the first in what Huntress assessed was likely an effort to evade detection.
Huntress observed HideUL_x64.exe, assessed as a defense-evasion tool, and a scheduled task configured to run the PowerShell script every two minutes. The SOC shut down that attack.
A retroactive hunt found that a unique ScreenConnect client and configuration associated with one RMM also affected 22 endpoints across separate incidents.
Huntress recommends reviewing protections for links on trusted cloud services, monitoring for unapproved ScreenConnect clients and related scheduled tasks or scripts, and investigating endpoints with multiple RMM tools.

Article Details

Attack Vectors: Phishing email with an embedded link to a fake reference document hosted on a legitimate Microsoft Power BI domain.
The fake document opened attacker-controlled landing pages that fingerprinted visitors and triggered delayed downloads of rogue ScreenConnect installers.
PowerShell and a CMD file were used in one incident to download and execute a second ScreenConnect installer.
A scheduled task was configured to run SCAutoFix.ps1 every two minutes.
Defensive Notes: Review phishing protections and user-reporting workflows for links hosted on trusted cloud services, particularly links that lead to downloads or request sensitive actions.
Monitor for unexpected ScreenConnect installations, connections to unapproved ScreenConnect instances, and scheduled tasks or scripts associated with remote access tools.
Where possible, restrict remote management software to approved instances and investigate endpoints with multiple RMM clients installed.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`instance-g01s1n-relay[.]screenconnect[.]com`	ScreenConnect instance associated with the initial rogue client.
DOMAIN	`onthegotree[.]site`	Infrastructure associated with the secondary rogue ScreenConnect client.
SHA256	`5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3`	SHA-256 hash of the initial rogue ScreenConnect client.
SHA256	`f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35`	SHA-256 hash of the secondary rogue ScreenConnect client.
URL	`hxxps[:]//app[.]powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9`	Specific Power BI dashboard URL identified as the phishing lure.
URL	`hxxps[:]//burnsworth[.]site/S/main.html`	Attacker-controlled landing page used for victim fingerprinting and payload delivery.
URL	`hxxps[:]//check[.]vykyn[.]click/E/`	Redirect destination used for visitors who failed the landing page's filtering checks.
URL	`hxxps[:]//dailylifeproject[.]site/S/`	Attacker-controlled landing page used for victim fingerprinting and payload delivery.
URL	`hxxps[:]//essaywritingservice[.]site/S/main[.]html`	Attacker-controlled payload-staging website used in campaign variants.
URL	`hxxps[:]//hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN`	Specific installer download URL used to deliver the rogue ScreenConnect client.
URL	`hxxps[:]//hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE`	Specific installer download URL used to deliver the rogue ScreenConnect client.
URL	`hxxps[:]//hamham27[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO`	Specific installer download URL used to deliver the rogue ScreenConnect client.
URL	`hxxps[:]//onthegotree[.]site/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest`	Attacker-controlled URL used by SCAutoFix.ps1 to download the second ScreenConnect installer.
URL	`hxxps[:]//openpediatrics[.]site/S/main.html`	Attacker-controlled payload-staging website used in campaign variants.