Sam's News — email-security — 2026-10-12¶
Security¶
7 Microsoft Power BI phishing campaign deploys ScreenConnect RMMs for persistent access¶
Attackers used phishing emails targeting Microsoft Power BI to deploy rogue ScreenConnect remote management tools for sustained system access.
- Campaign started Sept 10, 2026
- Exploits trusted Microsoft domain to bypass email filters
- Malware fingerprints OS, browser, screen size, automation, cloud-provider data
- ScreenConnect clients from attacker-controlled domains
- Huntress found 22+ affected endpoints across incidents; initially affected handful
Sources: CyberSecurityNews RSS Update to: Power BI phishing campaign deploys rogue ScreenConnect clients
6 Over 31,000 scam emails exploit Microsoft authentication system in seven weeks¶
Security researchers detected more than 31,000 phishing emails abusing Microsoft's authentication systems over a seven-week period.
- Over 31,000 fraudulent emails identified August 1–September 18, 2026
- Two attack vectors: fraudsters registered Microsoft apps with malicious redirect URIs; attackers used Entra admin center to create bogus users and set victims' emails as backup mailboxes
- Scams mimicked official Microsoft communications urging credential updates or electronic document signatures
- Attacks harder to detect because fraudulent links sent through official Microsoft services rather than spoofed addresses
- Attackers purchased cheapest Microsoft licenses or used trial periods to access Entra admin center
Sources: The Citizen RSS Update to: Security Firm Detects 31,000 Fraudulent Emails Exploiting Microsoft Authentication Systems