Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many organizations when a multitenant app already has wide permissions.

The affected product is ConnectWise Cloud Backup, formerly known as SkyKick Backup. Managed service providers use the platform to protect Microsoft 365 and Google Workspace data. To perform backup and recovery tasks, the Microsoft 365 app may receive access to Exchange mailboxes, OneDrive, SharePoint, Teams, and directory information.

Microsoft Threat Intelligence confirmed it is tracking an active supply chain attack involving ConnectWise Cloud Backup (formerly SkyKick Backup).

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens… pic.twitter.com/5FF8H30jaX
— Microsoft Threat Intelligence (@MsftSecIntel) October 17, 2026

Compromised Credential Used Across Tenants

Huntress confirmed that an API secret belonging to the vendor was compromised and used for unauthorized Microsoft 365 access. Later reporting placed the number of confirmed partner and customer tenants at 173. The login records showed a client assertion, meaning the secret came from the vendor’s home tenant rather than from a password or action inside each customer environment.

The attackers used the ConnectWise Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. On October 15, 2026, the app signed in from 144.172.64[.]128 and received Microsoft Graph access tokens between 06:13 and 08:34 UTC. The actor moved through tenant identifiers in order, only seconds apart, which points to an automated script using a prepared target list.

This was not a normal user login. The attacker signed in as the trusted application and received tokens carrying the permissions that customers had already approved. User passwords and regular MFA prompts were not needed because the activity used an app-only identity.

Global Administrator Access Observed

The most serious activity appeared in one Huntress partner tenant. A second app named ConnectWise Cloud Management – MS Teams, with application ID 24205314-2b89-4e07-a2a4-579e898a5640, assigned itself the Global Administrator role. It then used a Python script to add new client secrets to two other trusted applications.

Those added secrets were set to expire in 2028 and could allow the attacker to return through the affected applications. Disabling the original ConnectWise apps does not remove credentials already planted in other app registrations. This is why defenders must review all app secrets and certificates, not only the ConnectWise entries.

Microsoft sign-in logs also showed the second application connecting from the private IPv6 range fde4:8dba:2600:37ce:6d26:200:a76:*. However, Huntress warned that legitimate ConnectWise and unrelated customer traffic can use the same internal Microsoft cloud range. The address alone should not be treated as proof of malicious activity.

The case follows a wider rise in OAuth and service principal abuse. Cyber Security News previously reported how hackers use OAuth apps in Microsoft Entra ID for persistence, even after password resets. Another recent investigation covered an 81 million-login Microsoft 365 password spray campaign that abused Azure CLI and legacy OAuth flows.

Security teams should check the Service principal sign-ins view in the Microsoft Entra admin center because the default user sign-in page will not show this activity. They should filter for the Cloud Backup application ID and search for 144.172.64[.]128, unusual public IP addresses, and unexpected Graph API activity.

ConnectWise also listed Python-urllib/3.12 and python-requests/2.31 as observed user agents. These values are weak signals by themselves because Python tools are common in normal administration. Stronger evidence comes from linking the user agent with the source IP, application ID, role changes, and actions such as “Add service principal credentials” or “Update application.”connectwise+1

Defenders should review Entra audit logs for ConnectWise or SkyKick applications adding themselves to directory roles. They should also inspect every enterprise application and app registration for client secrets or certificates added since October 13, 2026. A lack of visible file or email access does not rule out data exposure because some Microsoft Graph directory reads leave little or no useful audit evidence.

Impacted organizations should disable, but not delete, the ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams service principals. Deleting them removes consent and may make service recovery harder. Disabling the applications pauses automated backups but does not delete backups already stored by ConnectWise.

Administrators should remove any directory role that was not approved, delete unknown app credentials, review Conditional Access exclusions, and keep the affected apps disabled until ConnectWise confirms that all vendor secrets have been reset. ConnectWise said containment measures were in place and that it had no indication that partner backup data was accessed at the time of its security advisory.

Huntress has published detailed checks and updated indicators in its technical investigation. The threat actor has not been publicly identified, and the full scope remains under investigation. Organizations should act on the confirmed sign-ins and persistence signs rather than wait for proof that files or messages were taken.

Indicators of Compromise

IOC Type	Indicator	Description
Application name	`ConnectWise Cloud Backup`	Trusted backup application abused to access Microsoft 365 customer tenants
Application ID	`506e08f9-6e9a-4da4-942b-a099a03644ae`	Legitimate ConnectWise Cloud Backup OAuth application, formerly SkyKick Backup
Publisher	`SkyKick`	Publisher name associated with the affected application
Source IP address	`144.172.64[.]128`	IP address linked to suspicious service principal authentication and related activity
User agent	`Python-urllib/3.12`	Python user agent observed during suspicious activity
User agent	`python-requests/2.31`	Python Requests user agent associated with the authentication activity
User agent	`python-requests/2.34.2`	Additional Python Requests user agent reported by Microsoft

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts appeared first on Cyber Security News.