A familiar domain carried the lure
Huntress published an October 7 investigation into phishing activity first observed September 10. Attackers used public Microsoft Power BI pages to present a fake document reference. Following the download prompt led to attacker-controlled pages and a ScreenConnect installer. The researchers describe multiple unauthorized remote-access clients used to maintain access, along with scripts and scheduled tasks.
The product name does not establish authorization
Huntress recommends investigating unexpected installations and connections to unapproved ScreenConnect instances. Its report also describes a retrospective match involving 22 other endpoints across separate incidents; that is not a count of newly breached customer organizations. The research concerns abuse of legitimate services and remote-management software, not a claim that Power BI or every ScreenConnect installation is compromised.
Build an instance-level inventory
For an MSP supporting a small professional-services firm, our assessment is that an approved-software list needs more detail than a vendor name. Record the authorized management instance, the team operating it, the customer scope and the process that installs its client. A technician should be able to explain an installation without relying on the fact that its name looks familiar. The customer should also know whether its application vendor, copier contractor or previous IT provider maintains separate remote access. Those arrangements need a business owner and a review date, even when the software itself is legitimate.
Define the handoff when a second client appears
An unexpected remote-access client should trigger a documented investigation that preserves the evidence needed to understand how it arrived. Removing one program is not a complete incident conclusion. Agree who can isolate a device, inspect related activity and communicate any interruption to the employee. For customers with multiple IT suppliers, settle which provider coordinates the response so that cleanup actions do not conflict or destroy useful records. After resolution, compare the endpoint against its approved configuration and close any installation path that bypassed that process. This provides a concrete service standard: remote access is authorized by an accountable relationship, not merely recognized by an antivirus label.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
