Email scamStill active

Power BI "Download Reference" link installs ScreenConnect remote access on your PC

A link in an email opens a Microsoft Power BI page with a "Download Reference" button that quietly installs ScreenConnect.

By the Xcelcor Guardian team · Reported October 12, 2026

Is it a scam?: Yes, it's a scam. The page sits on Microsoft's real Power BI site, but Microsoft didn't make it and the "reference" download is remote access software for the attackers.
Type: Email scam
First reported: October 7, 2026
Status: Still active
Who it targets: People who use Outlook email, including at work
Tools it uses: ScreenConnect, Microsoft Power BI (abused)

If an email link took you to a Microsoft Power BI page showing a blurred form and a "Download Reference" button, don't click it. If you already did and opened the file, it most likely installed ScreenConnect, a real remote access program, set up so strangers can get into your computer.

Researchers at the security company Huntress reported this campaign on October 7, 2026. They say it began around September 10, 2026, and hit a handful of computers. They later found the same ScreenConnect setup on 22 more computers, though they couldn't confirm all of those came from this campaign. So far this comes from one security company's research, so some details may change.

What does the Power BI page look like?

It starts with an email in Outlook with a link. Huntress couldn't get a copy of the email itself, so we don't know its subject line or sender yet.

The link opens a page on app.powerbi.com, which is Microsoft's real Power BI website. Because the address is genuine, it looks safe. The page shows a blurred document and a "Download Reference" button. Clicking it opens a new tab on another site, such as dailylifeproject.site, and a file downloads. GBHackers reports the download is presented as a "Reference Verification Form".

What happens if you open the file?

According to Huntress, the file installs ScreenConnect connected to the attackers' account. A hidden script then downloads a second copy of ScreenConnect and removes the first, so the attackers have a fresh way back in. They also ran a program Huntress believes is meant to hide their activity. In one case a scheduled task named SCAutoRepairEvery2Min re-ran the script every two minutes to keep the access alive.

I got the email but didn't click

Delete it. If it came to a work address, report it to your IT team so they can warn others.

I opened the file. What now?

Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
If it's a work computer, call your IT team now and don't try to clean it yourself.
At home, go to Settings, then Apps, then Installed apps (or "Apps & features" on Windows 10) and uninstall any ScreenConnect Client you didn't install. There may be more than one.
Change your email password from a different device, then your bank passwords.
If you do banking on that PC, call your bank using the number on the back of your card.

Our two-minute checklist walks through each step. How to tell if someone is controlling your PC explains what to look for afterward, and the full list of web addresses and file names is on this page and in the Huntress report.

How to tell it's fake next time

A real Microsoft address doesn't make a page safe. Power BI, like other sharing sites, lets anyone publish pages. Be wary of any "reference", "document" or "form" that wants you to download and run a program, especially one ending in .exe. Our ScreenConnect scams guide covers the other tricks used to install it.

Xcelcor Guardian holds every new remote connection on a Windows 11 PC, including ScreenConnect, until the account holder approves it by email or on xcelcor.com. It isn't antivirus and won't remove the program, but a stranger's connection request would wait for your answer.

Phone numbers, messages and files linked to this scam

Web addresses are written with [.] so they can’t be clicked by mistake. If something you received matches, it’s this scam.

What the message or pop-up says

Download Reference
Button on the blurred Power BI page

Reference Verification Form
Name of the download, as reported by GBHackers

Websites

dailylifeproject[.]siteDownload site the button opens
burnsworth[.]site
essaywritingservice[.]site
openpediatrics[.]site
check[.]vykyn[.]clickWhere some visitors get redirected
hamham27[.]screenconnect[.]comScreenConnect account the installer comes from
onthegotree[.]siteUsed by the second ScreenConnect copy

Files

ScreenConnect.ClientSetup.exe
SCAutoFix.ps1
LyN03DvVjUKPrun.cmd
HideUL_x64.exe

Other signs

SCAutoRepairEvery2MinScheduled task name seen in one case

Questions people ask

Is the Power BI "Download Reference" page real?

The website address is real Microsoft Power BI, but anyone can publish a page there. This one was made by attackers, and the download is remote access software.

I clicked Download Reference and opened the file. What now?

Disconnect the PC from the internet and tell your IT person if it's a work computer. At home, follow our checklist and uninstall anything called ScreenConnect you didn't install yourself.

How do I know if ScreenConnect is on my computer?

Open Settings, then Apps, then Installed apps ("Apps & features" on Windows 10) and look for ScreenConnect Client. If you didn't put it there, that's a warning sign.

Sources

Last updated October 12, 2026