Stolen ConnectWise Cloud Backup Credential Used to Access 173 Microsoft 365 Tenants

An attacker holding a compromised credential for ConnectWise Cloud Backup (formerly SkyKick) has been signing in to customers' Microsoft 365 environments, with confirmed unauthorized access observed in 173 partner and customer tenants. Because the credential belongs to the backup application itself — not to any one user — every tenant where the app is consented is potentially exposed until the vendor rotates it.

What happened

ConnectWise Cloud Backup is used by managed service providers (MSPs) to protect their clients' Microsoft 365 and Google Workspace data. To do that job, it is granted wide-reaching permissions: mailboxes, OneDrive, SharePoint, Teams and directory data across every tenant where it is installed.

According to researchers at Huntress, an unknown actor used the application's credential to request Microsoft Graph tokens across customer tenants on 15 October 2026, between 06:13 and 08:34 UTC, from the IP address 144.172.64[.]128. The sign-ins moved through tenants in sorted GUID order a few seconds apart — a pattern consistent with an automated script working from a target list. The same IP was seen password-spraying four law-firm tenants on 13–14 October, though Huntress reported no successful user logins from that activity.

In at least one partner tenant, the activity went further. A separate ConnectWise app (ConnectWise Cloud Management for Microsoft Teams) added itself to the Global Administrator role and then, via a Python script, added new client secrets to two other privileged applications — an MSP management tool and a security platform. Secrets planted on apps like these can reach beyond a single tenant, because such tools are frequently consented into many downstream customer tenants.

Todyl independently reported an unauthorized party authenticating to Microsoft Graph as the Cloud Backup application, inheriting its existing consent — including read/write mail access via Exchange Web Services, OneDrive and SharePoint files, and Teams chats.

ConnectWise has closed Cloud Backup application access until further notice and says it has found no evidence that partner backup data was compromised. Attribution has not been made public, and the investigation is ongoing.

Why it matters

This is a textbook third-party / non-human identity risk. No user password was phished and no MFA prompt was bypassed — the attacker simply became a trusted application that already held broad consent.

• Revoking user sessions does not help. The access belongs to a service principal, not a person.
• Disabling the app is not instant. It stops new tokens in that tenant, but tokens already issued can remain valid for up to roughly 90 minutes.
• Visibility is limited. Some Graph activity, such as directory reads, may leave little or no audit trail by default, so the absence of evidence is not evidence of absence.
• Blast radius multiplies through MSPs. One vendor credential, many tenants — and potentially many more if secrets were added to other multi-tenant tools.

What to do

If you — or your MSP — use ConnectWise Cloud Backup / SkyKick:

1. Disable the application in your tenant until ConnectWise confirms all credentials have been rotated.
2. Hunt in Entra sign-in logs. In the Microsoft Entra admin center go to Monitoring → Sign-in logs → Service principal sign-ins (the default user sign-ins view will not show this) and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
3. Check source IPs. Look for authentications from outside expected Microsoft/Azure ranges — the app normally egresses from Azure private IPv6 — and specifically for 144.172.64[.]128.
4. Audit new credentials. Review every application and service principal for secrets or certificates added since 13 October 2026, paying close attention to MSP management and security tooling.
5. Review role changes. Search Entra audit logs for any ConnectWise or SkyKick application adding itself to a directory role, especially Global Administrator.
6. Turn on Microsoft Graph activity logs so future service-principal activity is recorded.
7. Ask your MSP directly whether they use the product, what they have checked, and whether any of their own multi-tenant apps received new secrets.

Longer term, treat third-party app consent as privileged access: inventory it, trim permissions to what is strictly needed, and monitor service principals as closely as admin accounts.

Reporting based on public research from Huntress and Todyl, ConnectWise's incident notice, and initial coverage by The Hacker News.