The Attack: Trusted Domains Delivering Malware
A recent phishing campaign demonstrates why domain reputation filtering isn’t enough. Attackers created malicious reports hosted on app.powerbi.com — Microsoft’s own Power BI platform — and sent links via email to corporate targets.
Because the URL is a legitimate Microsoft domain, secure email gateways and Microsoft 365 Defender let the messages through. SPF, DKIM, DMARC — all pass. Safe Links doesn’t flag it. The email lands in the inbox.
The recipient clicks the link and sees what looks like a blurred confidential document with a “Download Reference” button. Click that button, and after some browser fingerprinting to avoid sandboxes and security researchers, the site serves ScreenConnect.ClientSetup.exe — a legitimate, digitally signed ConnectWise ScreenConnect installer configured to connect to the attacker’s server.
ScreenConnect is a widely trusted remote monitoring and management tool. The binary itself isn’t malicious. But once installed, it gives the attacker full remote desktop control, command execution, and file transfer capabilities.
The persistence mechanism is where it gets nasty. The initial installer runs a PowerShell script (SCAutoFix.ps1) that:
- Installs a second ScreenConnect client pointing to a backup server
- Uninstalls the first client to confuse incident responders
- Creates a scheduled task (SCAutoRepairEvery2Min) that reinstalls both clients every two minutes
- Drops a concealment utility (HideUL_x64.exe) to hide the RMM interface from the user
Security teams terminate the process, delete the files — and two minutes later, it’s back.
Why Traditional Defenses Failed
Email security relies on domain reputation. Microsoft owns app.powerbi.com, so it’s trusted. Antivirus relies on signatures. ScreenConnect.ClientSetup.exe is a legitimate binary with a valid digital signature, so it’s trusted.
The attack doesn’t need to defeat detection. It uses infrastructure and software that are already trusted.
How FileSure Blocks It at the File System Layer
FileSure operates at the Windows kernel level and intercepts file operations before they complete. It doesn’t care whether the domain is trusted or the binary is signed. It enforces a simple rule: certain programs are not allowed to write certain file types to disk.
The attack stops at the earliest point: when the browser attempts to save ScreenConnect.ClientSetup.exe to the Downloads folder.
Here’s the specific rule configuration that would have prevented this attack:
File name filter: *.exe;*.msi;*.dll;*.bat;*.cmd;*.ps1;*.vbs;*.js
Program name filter: \msedge.exe;\chrome.exe;\firefox.exe;\iexplore.exe
Operations: Write, Create
Drive type: Hard drives, Workstations
Result: Browsers cannot write executable or script files to local drives. The ScreenConnect installer never lands on disk.
No download means no installation. No installation means no RMM foothold. No foothold means no secondary client, no scheduled task, no persistence, no remote access.
The attack is blocked before it starts — not because FileSure recognized ScreenConnect as malicious, but because it enforces what browsers are allowed to do at the file system level. A ransomware variant from this morning gets stopped the same way as a legitimate RMM tool abused by an attacker.
Even if the attacker tried a different delivery method — email attachment instead of browser download — the same principle applies. Block Outlook from writing executable files, and the payload never lands.
Try It Yourself
Install FileSure on a test system. Configure the browser write-blocking rule above. Try downloading an .exe file from any website. Watch it get blocked and logged in real time.
That’s the whole demo. It works exactly like that, every time, for every executable delivery attempt.
Start your free 21-day trial at bystorm.com — no credit card required.
Source: Hackers Abuse Microsoft Power BI to Deliver ScreenConnect Malware in New Phishing Campaign
Category: Threat Intelligence
Tags: screenconnect, power bi phishing, rmm abuse, kernel filter driver, file system security, executable blocking, browser malware delivery
