Compromised ConnectWise Credential Used to Access Microsoft 365 Tenants
Summary
An unknown actor abused a ConnectWise-held credential to obtain Microsoft Graph tokens in customer tenants. Unauthorized sign-ins were confirmed in at least 162 tenants; ConnectWise reportedly disabled affected applications, and the investigation continues.
Key points
- From at least October 13–16, 2026, an unknown actor used a compromised credential for ConnectWise Cloud Backup, formerly SkyKick, to obtain Microsoft Graph tokens across customer tenants.
- Unauthorized sign-ins were confirmed in at least 162 tenants; nearly 1,000 tenants reportedly had sign-in activity from the primary source IP, with more than 300 successful sign-ins.
- Related ConnectWise Cloud Management applications were also abused, including self-assignment of Global Administrator and creation of client secrets on other applications for persistence.
- The credential is vendor-held and can work across tenants that consented to the application; customer credential rotation does not resolve the issue. The article says no CVE applies.
- ConnectWise reportedly disabled affected applications on October 17. Existing tokens may remain valid for up to 90 minutes, and malicious secrets added to other applications may remain active.
- The article recommends disabling the associated service principals, reviewing role assignments and application secrets, and keeping the applications disabled until ConnectWise confirms the credential reset.
- ConnectWise reported no evidence that Cloud Backup customer backup data was compromised; the investigation was ongoing, and disabling the applications could interrupt automated backups.
Article Details
- Victim Organization
- Customer Microsoft Entra ID and Microsoft 365 tenants; specific organizations not disclosed
- Incident Type
- Supply-chain attack involving a compromised vendor-held application credential and OAuth service-principal abuse
- Incident Date
- 2026-10-13
- Data Types Exposed
- Mail, OneDrive, SharePoint, Teams, and directory data were within the application's reported access scope; access to or compromise of this data was not confirmed.
- Affected Records
- At least 162 tenants had confirmed unauthorized sign-ins as of October 16, 2026; the number of affected records was not disclosed.
- Operational Impact
- Disabling the affected applications halts automated backup operations. Existing backups remain available, but backup protection gaps may develop during the outage. The source reports unauthorized sign-ins and role and credential changes, but does not confirm customer backup data compromise.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1098.001 · Additional Cloud CredentialsClient secrets were added to an MSP management application and the Huntress application, reportedly for persistence.T1098.003 · Additional Cloud RolesConnectWise Cloud Management service principals assigned directory roles to themselves in monitored tenants, including a reported self-assignment of Global Administrator.T1110.003 · Password SprayingPassword spraying targeted user accounts between October 10 and 14; no successful user sign-ins were observed from this activity.
Vendors
ConnectWiseOctober 16, 2026, an unknown threat actor used a compromised vendor-held credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer MicrosoftMicrosoftcredential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The credential resides in the
Products
Azure Resource ManagerTargeted services included Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra ID, and Office 365 Management APIs.ConnectWise Cloud Backup16, 2026, an unknown threat actor used a compromised vendor-held credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra IDConnectWise Cloud Managementhas been consented. As a result, risk is not limited to the tenants confirmed so far. Related ConnectWise Cloud Management applications were also abused, including self-assignment to Global Administrator and creationExchange OnlineCloud Management - Exchange OnlineMicrosoft 365 Apps for Enterpriseapplication (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The credential resides in the vendor's own tenant and functions across every tenant where theMicrosoft Entra IDCloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The credential resides in the vendor's own tenant and functions acrossMicrosoft Graphcredential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The credential resides in theSharePoint OnlineCloud Management - SharePoint OnlineSkyKicka compromised vendor-held credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) to obtain Microsoft Graph tokens in customer Microsoft Entra ID and Microsoft 365 tenants. The
Industries
Critical mineralsOctober 15 from 09:25 to 12:35 and again from 13:54 to 14:20A second wave targeted 16 tenants in policy, national security, trade, and critical minerals sectors.National securityOctober 15 from 09:25 to 12:35 and again from 13:54 to 14:20A second wave targeted 16 tenants in policy, national security, trade, and critical minerals sectors.PolicyOctober 15 from 09:25 to 12:35 and again from 13:54 to 14:20A second wave targeted 16 tenants in policy, national security, trade, and critical minerals sectors.TradeOctober 15 from 09:25 to 12:35 and again from 13:54 to 14:20A second wave targeted 16 tenants in policy, national security, trade, and critical minerals sectors.