The Power BI Report That Was Really a Vishing Lure

A senior corporate paralegal at a mid-size biopharmaceutical company opened what looked like the most boring email in the world: an automated Power BI subscription report. That is a real Microsoft feature. Power BI can email a scheduled snapshot of a dashboard on a set cadence, and inboxes across the enterprise learn to treat those messages as routine telemetry that never asks for anything.

This one asked for something. Buried inside the Microsoft-branded report template was scam text claiming a PayPal charge had gone through for a Zoom subscription renewal, with a toll-free number to call and dispute it. The report was never the point. It was the envelope.

What makes this case worth a teardown is the sheer economy of it. The attacker did not register a lookalike domain, did not stand up a credential-harvest page, and did not attach a payload. They borrowed a trusted automated reporting tool and stacked the trust of three well-known brands, Microsoft, PayPal, and Zoom, inside a single message, then pointed the victim at a phone.

An Automated Report as the Delivery Vehicle

The message arrived as a genuine Power BI subscription report, complete with the service's own HTML layout and a visible From address of no-reply-powerbi@microsoft.com. That address is the real sender identity Power BI uses for scheduled reports, which is exactly why it reads as safe.

The report itself was not generated by Microsoft corporate. It came from a tenant subdomain, progettoinsiemesigillo.onmicrosoft[.]com, an Office 365 tenant either controlled or compromised by the attacker. Anyone can spin up a Power BI subscription inside a tenant they own, and the resulting notification carries the Microsoft template and the microsoft.com From address regardless of what the underlying report contains. The attacker used that gap to inject unrelated billing-fraud text into a fully branded, expected-looking automated email.

Inside the report body, the copy switched brands entirely. It described a PayPal transaction, framed it as an auto-renewal charge for a Zoom account, and instructed the reader to call +1-800-305-3282 to cancel or contest the charge. No link to click, no form to fill. Just a number.

Why the Phone Number Is the Payload

Skipping the link is a deliberate move. A URL gives a security tool something to inspect: reputation, redirect chain, landing-page content, certificate age. A phone number gives it nothing. There is no destination to scan, no domain to block, and no page to render in a sandbox.

The victim who dials in reaches a live operator working a script. This is vishing, the voice-driven cousin of email phishing, and in this pattern it functions as a telephone-oriented attack delivery chain: the email exists only to move a target from the inbox to the call, where the real social engineering happens off any monitored channel. On that call, an attacker can walk a panicked reader through installing remote-access software, reading back card details to reverse a charge that never existed, or authorizing a refund that quietly runs the other direction.

See Your Risk: Calculate how many threats your SEG is missing

Mixed Authentication, Delivered Anyway

The authentication trail on this message is a study in why a single verdict at a single hop is not the whole story. At earlier ARC hops, SPF, DKIM, and DMARC all passed for microsoft.com, because the Power BI reporting infrastructure is legitimately Microsoft-signed at origin.

By the final hop, after the message transited a Mimecast inbound relay, the picture inverted. Sender Policy Framework failed for the sending IP 170[.]10[.]132[.]61. DomainKeys Identified Mail failed on a body-hash mismatch, consistent with content being modified in transit. Domain-based Message Authentication, Reporting and Conformance failed as well, and the receiving edge logged action=oreject, a reject verdict.

On paper, a reject outcome should have stopped delivery. It did not. The message still reached the mailbox, where it was subsequently auto-flagged as phishing. The reputation of an established, Microsoft-originated reporting service, combined with the auth passes at earlier hops, was enough to carry it past the point where the final-hop failure should have mattered. Authentication keeps teaching the same lesson: it validates transport, not intent, and a trusted service can launder both.

Mapping to MITRE ATT&CK

The tradecraft maps to a small, tight set of techniques in the MITRE ATT&CK framework. T1566.002 Spearphishing Link describes the delivery through a service-generated message, here a subscription report rather than a hand-crafted email. T1656 Impersonation covers the layered brand deception across Microsoft, PayPal, and Zoom. And T1598 Phishing for Information captures the callback objective, pulling payment details and account access out of the victim over the phone.

Indicators of Compromise

Detection and What to Watch For

Reputation and link scanning were never going to catch this. The infrastructure is a real Microsoft service, the From address is authentic, and there is no URL to weigh. Detection has to move to content and intent: an automated report from a tenant that has no business relationship with the recipient, billing language for a product the organization does not use, brand mixing inside a single message, and a toll-free number presented as the only way to act.

This is where Microsoft 365 augmentation earns its place. Themis, the Adaptive AI analyst on the IRONSCALES platform, reads the relationship between the claimed service, the tenant that actually generated the report, and the fraud pattern in the body the way a trained analyst would, flagging the abuse even when the transport looks Microsoft-clean. Across 35,000+ security professionals in 17,000+ organizations, the recurring theme is attackers renting trust rather than forging it. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and names pretexting, largely business email compromise, as the top social-engineering incident type, with a median transaction near 50,000 dollars. The Microsoft Digital Defense Report 2024 documents the same drift toward abusing legitimate cloud services rather than breaking them, and the FBI's 2023 Internet Crime Report ranks callback and tech-support fraud among the most damaging schemes reported.

The Takeaway

Trusted automation is a blind spot precisely because it is boring. A Power BI report, a calendar invite, a delivery notification: these are the messages users are trained not to scrutinize. When an attacker can generate one from a tenant they control, the brand does the persuading for free, and a phone number does the rest. Treat unexpected billing claims as suspect no matter how legitimate the wrapper looks, verify charges directly with PayPal or Zoom through their own apps rather than a number in an email, and pair that habit with detection that reads intent instead of infrastructure. The next scam hiding inside a routine report is already scheduled to send.

CISA's guidance on recognizing and stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one

NIST's working definition of phishing is a useful baseline when documenting these cases: https://csrc.nist.gov/glossary/term/phishing

The 2024 Verizon Data Breach Investigations Report is available at https://www.verizon.com/business/resources/reports/dbir/