ConnectWise Backup Credential Used in Microsoft 365 Sign-Ins

A compromised ConnectWise Cloud Backup credential signed in to Microsoft 365 tenants—162 by Huntress on Oct. 16, later reported as 173.

Huntress reported that ConnectWise Cloud Backup (formerly SkyKick) application credentials were abused on October 15, 2026, to sign in to Microsoft 365 tenants from 144.172.64.128 and obtain Microsoft Graph tokens. Huntress said that by 19:00 UTC on October 16 it had confirmed unauthorized sign-ins in 162 tenants, while The Hacker News, citing Huntress on October 17, reported 173 partner and customer tenants and said the actor moved through tenants in sorted GUID order. The same address password-sprayed four law-firm tenants on October 13–14; The Hacker News said success was not confirmed. In one tenant, a ConnectWise Teams management app added itself as Global Administrator and created client secrets—expiring in 2028, according to Huntress—on an MSP management app and on Huntress’s own application, which The Hacker News named Huntress Security Platform. ConnectWise acknowledged the IP was tied to unauthorized activity, disabled Cloud Backup application access, and said it found no evidence that partner backup data was compromised; issued tokens can remain valid for up to 90 minutes. The backup app’s broad permissions can expose mail, files, and directory data in every tenant that consented to it.

• On October 15, 2026, abused ConnectWise Cloud Backup (formerly SkyKick) application credentials were used from 144.172.64.128 to sign in to Microsoft 365 tenants and obtain Microsoft Graph tokens.
• Huntress said it had confirmed unauthorized sign-ins in 162 tenants by 19:00 UTC on October 16, 2026; The Hacker News, citing Huntress on October 17, reported 173 partner and customer tenants and said the actor moved through them in sorted…
• The same IP password-sprayed four law-firm tenants on October 13–14; The Hacker News said success was not confirmed.
• In one tenant, a ConnectWise Teams/Cloud Management app added itself as Global Administrator and created client secrets on an MSP management app and on Huntress’s application (Huntress Security Platform); Huntress said those secrets expire…
• ConnectWise acknowledged the IP was tied to unauthorized activity, disabled Cloud Backup application access, and said it found no evidence that partner backup data was compromised.
• Issued tokens can remain valid for up to 90 minutes, and the backup app’s broad permissions can expose mail, files, and directory data in every consented tenant.