Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
Huntress observed unauthorized sign-ins to 173 Microsoft 365 partner and customer tenants using a compromised ConnectWise Cloud Backup application credential. The actor obtained Microsoft Graph tokens from 144.172.64.128 on October 15, 2026, moving through tenants in sorted GUID order. In one tenant, the ConnectWise Cloud Management app for Teams added itself as Global Administrator and created client secrets on an MSP app and Huntress Security Platform. ConnectWise disabled Cloud Backup application access and said it found no evidence that partner backup data was compromised; issued tokens can remain valid for up to 90 minutes.
80