INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs

| 2026-10-13 18:51 LOW MEDIUM MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems. The operation uses a fake reference document hosted on Microsoft’s real service, making the opening link appear safe before directing victims to attacker-controlled download pages. The attack does not depend on a reported […] The post Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access appeared first on Cyber Security News .
Technical Mitigations AI-generated
• Use CAPTCHA verification pages hosted on recently created domains to detect fake invitation pages. • Block or hunt for the domain hxxps://<a href="/auth/login?next=/detail/1uv_9aABAhlSTKR_FLsu" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>/EdesktopInvite/RsvpNow/invitedetails[.]php • Detect and block <a href="/auth/login?next=/detail/1uv_9aABAhlSTKR_FLsu" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> downloads from suspicious sources.
Technical Observables 56 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 56 IoCs Create Free Account
files 5 sha1 1 urls 12 sha256 15 domains 19 md5 4
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎July 2026
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below -…
tactic Phishing
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe ZoomSetup_Installation_v2.5.0.67_
infrastructure Windows
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe ZoomSetup_Installation_v2.5.0.67_
organisation MSP360 RMM v2.5.0.67
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe ZoomSetup_Installation_v2.5.0.67_
organisation MSP360 for Faronics Deploy
Microsoft said it also observed a separate set of attacks in July 2026 that switched MSP360 for Faronics Deploy Agent to find a way in, and then used it to download and install ScreenConnect.
‎2026/10/13
Threat actors used a phishing campaign that abused legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools.
organisation ScreenConnect
A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.
In September, a phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools.
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog .
organisation Microsoft
 Ravie Lakshmanan  Sep 30, 2026 Endpoint Security / Social Engineering Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog .
The operation uses a fake reference document hosted on Microsoft’s real service, making the opening link appear safe before directing victims to attacker-controlled download pages.
infrastructure Windows
A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.
Once launched, the installer drops multiple DLLs, while relaunching itself by invoking the Windows User Account Control (UAC) elevation workflow to run in a privileged context, establish persistent access by deploying MSP360, and leverage the RMM tool to execute PowerShell for stealthily installing ScreenConnect.
The installer also enumerates installed .NET runtimes and registers two Windows services ( RMM.Agent.exe and RMM.Agent.Launcher.exe) and creates Registry-based autorun entries to ensure that MSP360 is automatically launched when users sign-in to the machine.
organisation Microsoft Power BI
Microsoft Power BI Phishing Campaign
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs.
IOC - Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs.
organisation Cyber Security News
The attack does not depend on a reported […] The post Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access appeared first on Cyber Security News .
The email claims that a payment of $5745.65 has been received and invites the recipient […] The post Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing appeared first on Cyber Security News .
Victims who follow the […] The post Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs appeared first on Cyber Security News .
organisation PDF
 Ravie Lakshmanan  Sep 30, 2026 Endpoint Security / Social Engineering Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
Hackers are using familiar Zoom setup files and PDF reader downloads to place remote-control software on business computers.
organisation Deploy Rogue
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs.
IOC - Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs.
organisation CAPTCHA
The messages contain download buttons that redirect users through fake CAPTCHA verification pages hosted on recently created domains.
The attack uses a fake CAPTCHA and invitation page to deliver a legitimate ConnectWise ScreenConnect installer, which threat actors abuse as a remote access trojan (RAT) to gain control of victims’ devices.
organisation ConnectWise ScreenConnect
The attack uses a fake CAPTCHA and invitation page to deliver a legitimate ConnectWise ScreenConnect installer, which threat actors abuse as a remote access trojan (RAT) to gain control of victims’ devices.
The initial foothold is then used to download and install a ConnectWise ScreenConnect client, offering threat actors a redundant remote-access channel to compromised endpoints.
organisation RMM
Once launched, the installer drops multiple DLLs, while relaunching itself by invoking the Windows User Account Control (UAC) elevation workflow to run in a privileged context, establish persistent access by deploying MSP360, and leverage the RMM tool to execute PowerShell for stealthily installing ScreenConnect.
This button led to a new tab being opened on the browser, which then kicked off the download of multiple malicious ScreenConnect remote monitoring and management (RMM) instances.
organisation Endpoint Security /
 Ravie Lakshmanan  Sep 30, 2026 Endpoint Security / Social Engineering Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
organisation the MSP360 Remote Monitoring and Management (RMM
 Ravie Lakshmanan  Sep 30, 2026 Endpoint Security / Social Engineering Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
organisation The Cofense
The Cofense Phishing Defense Center (PDC) uncovered a phishing campaign that disguises malware as a digital event invitation, exploiting recipients’ curiosity to lure them into downloading a malicious file.
organisation Power BI
Attackers sent phishing emails with embedded links redirecting victims to fake reference documents hosted on Power BI infrastructure.
organisation IOC -
IOC - Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs.
organisation Hackers Abuse Legitimate ScreenConnect
Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing.
organisation MSP360 RMM
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog .
organisation Microsoft Security Blog
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog .
organisation ConnectWise Screen Connect
This delivers a zipped folder containing ScreenConnect.exe, a legitimate ConnectWise Screen Connect installer weaponized as a RAT.
organisation eInvite
After verification, users encounter another generic invitation page prompting them to download an eInvite file.
organisation the Windows User Account Control
Once launched, the installer drops multiple DLLs, while relaunching itself by invoking the Windows User Account Control (UAC) elevation workflow to run in a privileged context, establish persistent access by deploying MSP360, and leverage the RMM tool to execute PowerShell for stealthily installing ScreenConnect.
organisation Registry
The installer also enumerates installed .NET runtimes and registers two Windows services ( RMM.Agent.exe and RMM.Agent.Launcher.exe) and creates Registry-based autorun entries to ensure that MSP360 is automatically launched when users sign-in to the machine.
organisation Windows Firewall
Furthermore, it modifies the Windows Firewall configuration to allow inbound UDP traffic to MSP360 (i.e., RMM.Agent.exe) on port 48678.
organisation UDP
Furthermore, it modifies the Windows Firewall configuration to allow inbound UDP traffic to MSP360 (i.e., RMM.Agent.exe) on port 48678.
organisation Persistent Access
Deploys Rogue ScreenConnect RMMs for Persistent Access.
organisation Telegram
The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, while abusing trusted Microsoft domains to bypass email security controls and increase attack credibility.
organisation PDF Installers
Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs.
organisation MSP360
"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said .
organisation Microsoft Security Research
"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said .
organisation PDF Reader & Editor
oid[redacted].exe PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_ oid[redacted].exe RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_ oid[redacted].exe SSA.GOV_STATEMENT_rmm_v2.5.0.67_ oid[redacted].exe The installer packages are staged on attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
A phishing campaign is abusing Microsoft Power BI to deliver rogue ScreenConnect installations and give attackers lasting remote access to Windows systems.
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe ZoomSetup_Installation_v2.5.0.67_
Once launched, the installer drops multiple DLLs, while relaunching itself by invoking the Windows User Account Control (UAC) elevation workflow to run in a privileged context, establish persistent access by deploying MSP360, and leverage the RMM tool to execute PowerShell for stealthily installing ScreenConnect.
The installer also enumerates installed .NET runtimes and registers two Windows services ( RMM.Agent.exe and RMM.Agent.Launcher.exe) and creates Registry-based autorun entries to ensure that MSP360 is automatically launched when users sign-in to the machine.
Furthermore, it modifies the Windows Firewall configuration to allow inbound UDP traffic to MSP360 (i.e., RMM.Agent.exe) on port 48678.
Intelligence Sources
AlienVault OTX 2026-10-13
AlienVault OTX 2026-10-05
The Hacker News 2026-09-30
AlienVault OTX 2026-09-30
AlienVault OTX 2026-09-29
AlienVault OTX 2026-10-08
AlienVault OTX 2026-10-07
AlienVault OTX 2026-10-12
AlienVault OTX 2026-10-13