Medium Severity

Service abuse: Power BI shared document lure

Description

Detects inbound emails containing a link to app.powerbi.com with a /view path, combined with body text patterns commonly used to lure recipients into opening a supposedly shared document, file, or proposal. Attackers abuse Power BI's legitimate reporting platform to host and redirect to credential phishing pages, leveraging its trusted domain to bypass security filters and build recipient trust.

References

No references.

Sublime Security
Created Oct 23rd, 2026 • Last updated Oct 23rd, 2026
Source
type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain == "app.powerbi.com"
        and strings.istarts_with(.href_url.path, "/view")
)
and regex.icontains(body.current_thread.text,
                    'shared (?:a|an|the)\b[^.]{0,60}\b(?:document|file|proposal|folder|documentation)',
                    'review the attached',
                    'can only be (?:viewed|opened|accessed) (?:with|on|using)'
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started