![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/power-bi-document-scam-download-reference-screenconnect-illustration.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA real Microsoft page hosted the document lure<\/h3>\n
Huntress documented phishing that abused public Power BI pages<\/a> to direct recipients toward an unauthorized ScreenConnect installation.<\/p>\n The page presented a blurred form and a Download Reference button. A subsequent site checked the visitor’s environment before triggering a delayed installer download.<\/p>\n Focus on the switch from viewing a report to opening an executable. That is where an ordinary document request becomes a decision to install software.<\/p>\n The analyzed chain installed one rogue ScreenConnect client and then another. Researchers also observed concealment activity and a scheduled task that could rerun part of the installation.<\/p>\n Microsoft Power BI and ScreenConnect are legitimate products. The danger lies in attacker-created content and unauthorized remote-access enrollment, not normal use of either service.<\/p>\n A related configuration appeared on 22 additional endpoints across separate incidents. That finding is not a count of 22 confirmed victims of this exact phishing route.<\/p>\n The lead image is a fictional interface illustration using reports.example. It shows the document-versus-installer mismatch and is not an original Power BI capture.<\/p>\n A reference document sounds like something you might need for a project, transaction, or business discussion. Opening it can feel like a routine part of your job.<\/p>\n That doesn’t establish who created the content or whether the sender’s account is being used honestly. The actual business context still needs to fit.<\/p>\n Ask the supposed sender about the specific file through an established conversation. Do that before accepting a new installation as the price of viewing it.<\/p>\n The reported lure used app.powerbi[.]com, the real Power BI service. Attackers can publish content through legitimate platforms without owning those platforms.<\/p>\n A familiar hosting domain answers where a page is served. It does not establish that Microsoft approved a particular author’s reference form or its outbound download.<\/p>\n This matters when organizations routinely allow trusted cloud links. The destination can pass an initial reputation check while its content asks the employee to do something unsafe.<\/p>\n The practical check is what happens next. A reference document should not unexpectedly become a reason to give someone administrative access to your computer.<\/p>\n The Download Reference control opened another tab on attacker-controlled infrastructure. The first legitimate hostname therefore did not remain the destination throughout the journey.<\/p>\n When a new tab opens, notice the change. Do not mentally carry the first site’s reputation over to every website it links to.<\/p>\n If the original sender can provide the document through an approved sharing route, use that instead. You do not need to test the new tab’s download.<\/p>\n The researched pages checked browser and device characteristics before delivering the installer. Some visitors could be redirected away instead.<\/p>\n That means a coworker or automated checker may not see the same result you did. A blank page elsewhere does not make your downloaded file harmless.<\/p>\n Do not bypass a failed check by changing devices or weakening protection. Stop and provide the original link and download details to the appropriate security team.<\/p>\n After a short delay, page code triggered the download and displayed a success message. The notification encouraged the recipient to find the file in Downloads.<\/p>\n An automatic download can make the next action feel predetermined. You assume the file is the promised reference because the page just said it was.<\/p>\n Check the file type before opening it. ScreenConnect.ClientSetup.exe is an executable installer, not a plain reference document you can read like a PDF.<\/p>\n Saving that file and running it are different exposure levels. If it appeared in Downloads unexpectedly, leave it unopened and report the route.<\/p>\n The documented activity established a second ScreenConnect client. In one incident, the earlier client was then uninstalled as part of the sequence.<\/p>\n A disappearing application entry could therefore be misleading. It does not establish that remote access ended or that the device is ready for sensitive work.<\/p>\n The scheduled activity adds another question for recovery: what can restart the unwanted installation? A visible program list cannot answer that alone.<\/p>\n Let responders identify the controllers, services, and persistence involved. Do not delete every ScreenConnect file indiscriminately on a machine that may also have approved workplace support.<\/p>\n Power BI is used for reports, dashboards, and data visualization. A public report can contain content supplied by someone outside your organization.<\/p>\n ScreenConnect is used for remote support and administration. Its presence can be appropriate when your IT provider installed it and controls the connection with your knowledge.<\/p>\n This scam links those two forms of trust. A genuine hosting service helps the reference look credible, and a genuine administration product supplies the unwanted access.<\/p>\n The question is not whether ScreenConnect has a real website. Ask whether this particular installation was authorized, which controller it uses, and why a reference file introduced it.<\/p>\n If you are unsure, contact your normal help desk through established details. The reference page’s proposed support route cannot independently approve its own download.<\/p>\n If the executable never ran, don’t describe a confirmed remote takeover. Report the suspicious download and preserve the distinction between receipt and execution.<\/p>\n If the computer belongs to an employer, do not begin an improvised cleanup before IT decides what evidence to retain. Its response may include other affected systems.<\/p>\n Use another communication channel if you think the attacker can see the desktop. Avoid typing replacement passwords or sensitive incident notes into the potentially controlled machine.<\/p>\n The goal is to remove unauthorized access and establish a trustworthy system. Finding a legitimate product name or one clean scan is not enough to do that.<\/p>\n In the Windows Security app, open the Virus & threat protection area and look for Scan options. An available offline scan restarts the computer, so save work first.<\/p>\n Microsoft’s official scan instructions<\/a> explain that process. Review Protection history afterward, but do not use a clean result to dismiss documented remote enrollment.<\/p>\n If advised to use Malwarebytes, obtain it through the site’s verified download link<\/a>. Avoid any tool the reference page or an unknown caller recommends.<\/p>\n Open Malwarebytes and use the Scanner tile’s three-dot menu. Select Advanced Scan, choose Custom Scan, and configure the folders or drives to examine.<\/p>\n Review the results, quarantine confirmed threats, and follow any requested restart. A technician should evaluate findings you cannot confidently identify.<\/p>\n The current Custom Scan feature is free. Malwarebytes Premium<\/a> adds optional paid protection; buying it does not settle whether all remote access has been removed.<\/p>\n Ask which unauthorized clients were found, who controlled them, and what allowed them to return. The answer should address the installation chain, not just an application icon.<\/p>\n Find out whether sensitive accounts were used while the device was exposed. Account recovery may need to continue after the computer itself has been rebuilt.<\/p>\n Keep the recovery record with the incident details. That helps if another notification, scheduled task, or suspicious sign-in appears later.<\/p>\n Do not restore the original executable because you still need the reference document. Ask the real sender to provide the material through an approved sharing method.<\/p>\n If a managed support client remains installed, IT should be able to explain why it belongs there. Authorized remote support and covert attacker enrollment require different decisions.<\/p>\n For a personal device, ask your helper what remains uncertain. A clear explanation of recovery limits is more useful than a blanket promise that a cleaner fixed everything.<\/p>\n Start with the email and the download timeline. A responder can use those to connect the document request with later installation or service activity.<\/p>\n Retain any existing security alert and its detection name. A cropped message saying threat removed may leave out which component was actually found.<\/p>\n For this campaign, investigators may check scheduled activity associated with SCAutoRepairEvery2Min and SCAutoFix.ps1. Those names are investigation leads, not a complete home-removal checklist.<\/p>\n Do not create, run, or delete tasks merely because you recognize the names. Let qualified support examine the actual file, location, controller, and execution history.<\/p>\n Likewise, finding one known indicator does not establish that every other change matches the published case. Your computer’s recovery should follow its own findings.<\/p>\nThe downloaded software created remote access, not a readable document<\/h3>\n
The point where a document becomes a software decision<\/h3>\n
\n
How the Power BI Document Scam Works<\/h2>\n
Step 1: The shared reference gives the email a work-related purpose<\/h3>\n
Step 2: Microsoft’s domain makes the first page reassuring<\/h3>\n
Step 3: The download button leaves the trusted page<\/h3>\n
Step 4: The staging page decides what to show the visitor<\/h3>\n
Step 5: An automatic download is presented as successful document delivery<\/h3>\n
Step 6: More than one remote client makes a casual uninstall incomplete<\/h3>\n
What the Genuine Products Do<\/h2>\n
What to Do if You Opened the Download<\/h2>\n
\n
Checking and Recovering an Affected Windows Computer<\/h2>\n
\n
What to Ask Before Returning the Computer to Work<\/h2>\n
Keep Useful Evidence Without Testing the Installer<\/h2>\n