Attackers used a stolen ConnectWise app credential to break into Microsoft 365 tenants, researchers say

As of 1:50 p.m. ET, Sunday, Oct. 18, 2026

Attackers used a stolen credential belonging to ConnectWise's Cloud Backup application, formerly known as SkyKick, to sign in to customers' Microsoft 365 environments, according to security firm Huntress, Microsoft and ConnectWise.

Huntress said that as of 19:00 UTC on Oct. 16 (3 p.m. ET), it had confirmed unauthorized sign-ins in 162 tenants. The Hacker News reported on Oct. 17 that Huntress had observed confirmed unauthorized sign-ins in 173 tenants. The incident is ongoing, and the counts could change. In an update on Oct. 17, the firm said it had identified almost 1,000 Microsoft Entra tenants with sign-in activity from the attackers' IP address, more than 300 of them successful, though in some tenants the attacker could not gain access because the ConnectWise app was not installed.

Microsoft described the incident as an "active supply chain attack" in which a threat actor compromised the backup application's trusted OAuth app to obtain access tokens across customer tenants, The Hacker News reported.

How the attack worked

ConnectWise Cloud Backup is used by managed service providers to back up their clients' Microsoft 365 data, so the app holds broad access to mailboxes, OneDrive, SharePoint, Teams and directory data. Huntress said the app's credential was used on Oct. 15, between 06:13 and 08:34 UTC, to obtain Microsoft Graph tokens from a single hosting-provider IP address, moving through tenants a few seconds apart in a pattern that pointed to a script.

Because the sign-ins were made by an application rather than a person, there was no multifactor authentication prompt, Huntress said. In one tenant, a second ConnectWise app gave itself Global Administrator rights and added new credentials to two other applications, including one belonging to Huntress, the firm said.

Huntress said it had not confirmed what data, if any, was taken: in the one tenant audit log it reviewed in detail, the actor showed no mail or file access, but directory reads through Microsoft Graph leave no audit trail.

ConnectWise response

ConnectWise said it has suspended Cloud Backup, SaaS Security and Cloud Management, disabled seven application identities, and found no evidence that encrypted backup archives were accessed, according to its security advisory. In its most recent update, at noon ET Sunday, the company said its investigation and remediation were continuing and there were no new confirmed findings.

Huntress and ConnectWise advised customers to disable the affected ConnectWise apps in their tenants, without deleting them, and to review credentials added to any application since Oct. 13.

Why it matters

The incident shows how a single compromised vendor credential can open doors into many organizations at once, because backup and management tools are trusted with wide access to corporate email and files.