Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Organization
ConnectWise
- Mentions · 7d0
- Mentions · 30d6
- All mentions13
- First seenSep 3, 2026
- Last mentioned13d ago
Timeline
13 articles · newest firstHackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
78
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
84
Attackers Abuse Legitimate ScreenConnect Client in Phishing Campaign to Gain Remote Access
Phishers deliver a legitimately signed ConnectWise ScreenConnect client preconfigured to call back to attacker infrastructure, bypassing malware detection for remote access.
56
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
50
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.
71
Attackers Hid Behind Trusted RMM Software Before Deploying a Full Surveillance RAT
Attackers abuse signed RMM tools via fake Microsoft Store pages to deploy new .NET spyware RAT AgtaBackup with keylogging and browser data theft.
55
ConnectWise patches critical ScreenConnect authentication failure after five days
ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.
66
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
66
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
72
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
60
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
78
Related CVEs
by mentions- CVE-2024-1709100%10.0Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-3564<1%9.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain…
Appears with
- ConnectWisevendor · 11
- Huntressorganization · 7
- Microsoftorganization · 6
- ScreenConnectproduct · 6
- Microsoftvendor · 6
- ConnectWise Cloud Backupproduct · 4
- Microsoft 365product · 4
- Microsoft Graphproduct · 3
- Microsoft Entra IDproduct · 3
- Todylorganization · 2
- Huntressvendor · 2
- MSP360organization · 2
- rogue ScreenConnect clientmalware · 2
- Quick Assistproduct · 2
- Exchange Onlineproduct · 1
- GitLaborganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.