- Published on
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- Authors
- Name
- DeepHorus
Unknown threat actors compromised a Microsoft 365 credential tied to ConnectWise Cloud Backup and signed in to 173 partner and customer tenants, Huntress reported. The credential, formerly SkyKick, allowed unauthorized access to Microsoft 365 environments. Huntress warned the incident affects every organization with the app installed. The credential works against every tenant where the app is consented.
ConnectWise Cloud Backup is a cloud-based backup service for managed service providers. It secures clients' Microsoft 365 or Google Workspace data. The app has broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. This extensive permission set makes the compromised credential dangerous.
Huntress researcher Jonathan Semon said the credential is in hostile hands. It obtained Microsoft Graph tokens from IP 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, seconds apart, indicating a script working from a target list. The same IP password-sprayed four law firm tenants on October 13 and 14, 2026, without success.
In one partner tenant, a separate ConnectWise app assigned itself Global Administrator privileges. The ConnectWise Cloud Management app for Microsoft Teams added credentials to an MSP management application and Huntress Security Platform. Todyl's Nicholas Koken said the access inherited the app's existing consent. This permits read/write access to mail, files, Teams chats, and data restoration.
Revoking user sessions does not end this access, Koken added. Disabling the app stops new tokens, but issued tokens stay valid for up to 90 minutes. ConnectWise has closed Cloud Backup application access until further notice. It found no evidence partner backup data was compromised.
Security teams are urged to disable the app, rotate credentials, and audit privileged applications. Tenants with the app enabled stay exposed until ConnectWise rotates the credential. The campaign highlights risks of third-party app permissions in M365. The investigation is ongoing.
