ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
Huntress reports that ConnectWise Cloud Backup, formerly SkyKick, application credentials were abused on October 15, 2026, to sign in to customer Microsoft 365 tenants from 144.172.64.128 and obtain Microsoft Graph tokens. By 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants, and ConnectWise acknowledged the IP was tied to unauthorized activity. On October 13–14 the same address password-sprayed four law-firm tenants. In one tenant, a ConnectWise Teams app added itself to Global Administrator and created client secrets, set to expire in 2028, on an MSP management app and Huntress's own application. The backup app's broad permissions can expose mail, files, and directory data in every consented tenant.