A security research firm says unknown attackers used a stolen access credential belonging to a popular IT management tool to log into Microsoft 365 accounts across more than 170 organizations, in one of the more unusual supply chain incidents reported this month.
The credential belonged to ConnectWise Cloud Backup, a cloud backup product sold under the name SkyKick before ConnectWise acquired it, which managed service providers install inside their customers’ Microsoft 365 environments to protect mailboxes, files and Teams data. Like many backup and management tools, it needs broad permissions to do its job: the ability to read and write to mailboxes, OneDrive, SharePoint, Teams and a tenant’s directory data. That access is exactly what made the stolen credential valuable to an attacker.
According to the cybersecurity firm Huntress, the intrusion traces back to October 15, 2026, when someone using the IP address 144.172.64.128 began requesting Microsoft Graph access tokens inside customer tenants using ConnectWise’s application credential, rather than a compromised user password. Huntress said the activity moved through tenants in sorted order, a few seconds apart, the kind of pattern that points to an automated script working down a prepared list rather than a person typing by hand. Huntress has confirmed unauthorized sign-ins in 173 partner and customer Microsoft 365 tenants, and separately observed sign-in attempts touching nearly 1,000 Entra ID tenants overall, with about 300 of those attempts succeeding.
Microsoft has said the attacker likely abused high-level permissions such as Directory.ReadWrite.All, and that follow-on activity included reconnaissance through the Graph API and attempts to plant new credentials on the application itself as a way back in later. In at least one partner’s environment, Huntress found that a related ConnectWise application, Cloud Management for Microsoft Teams, had added itself to the Global Administrator role and then run a Python script to add new client secrets, both to an MSP’s own management tooling and, notably, to an application belonging to Huntress itself.
ConnectWise has said it identified the problem on October 14 through its own monitoring, and at 07:00 UTC on October 17 it disabled seven affected application identities, including Cloud Backup, Cloud Management, and several connected integrations for Teams, Exchange Online, SharePoint and Partner Center. The company suspended scheduled backups and archive access while it investigates, and says it has found no evidence that customers’ stored backup archives themselves were read or altered; those remain encrypted and isolated, according to ConnectWise. It has not yet said whether a flaw in its own software let the credential leak out in the first place, or whether it was obtained some other way.
One detail security teams are likely to find uncomfortable: ConnectWise has warned that simply disabling the application doesn’t retroactively undo anything an attacker already changed inside a tenant, and that access tokens issued before the shutdown can keep working for up to 90 minutes afterward. Huntress also noted that some of the directory reads carried out through the Microsoft Graph API leave no audit trail at all, which complicates efforts by affected organizations to work out exactly what the attacker saw.
Who is behind the intrusion remains unknown. Huntress flagged one curious pattern in its research: among the tenants targeted, a disproportionate number of the more interesting victims had organization names starting with the letter “A,” though the firm stopped short of drawing conclusions from that alone.
For managed service providers and any organization that uses ConnectWise Cloud Backup, or used SkyKick before the rebrand, both ConnectWise and Huntress recommend treating the application as compromised until told otherwise: keep the listed application identities disabled, review Entra ID sign-in logs for the flagged IP addresses (144.172.64.128, 144.172.64.99 and 144.172.64.60) going back to October 13, check whether any application has added itself to a privileged directory role, and audit for new client secrets added to trusted apps since that date.
Source: The Hacker News, with additional reporting from The Hacker News.
