---
date: 2022-09-02
description: "Recent research highlights a security vulnerability in Microsoft\u2019\
  s Power Automate tool that can be exploited to execute ransomware attacks on connected\
  \ systems. By leveraging the legitimate functionality of Power Automate, attackers\
  \ can hijack the automation process to deploy malware once a compromised user account\
  \ is configured with administrative rights. This RPA (Robotic Process Automation)\
  \ abuse exemplifies the risks inherent in low-code/no-code platforms and poses detection\
  \ challenges as these actions are indistinguishable from regular operations. Organizations\
  \ must enhance monitoring and implement stringent access controls to mitigate this\
  \ risk."
link: /archive/2022-09-02-a-windows-11-automation-tool-can-easily-be-hijacked-wired
tags:
- cybersecurity
- ransomware
- low-code/no-code
- Microsoft
- Power Automate
- weblog
title: "A Windows 11 Automation Tool Can Easily Be Hijacked \u25C6 WIRED"
type: weblog
---
{% raw %}

Hackers can use Microsoft’s Power Automate to push out ransomware and key loggers—if they get machine access first.

{% endraw %}