Unknown attackers used a compromised credential for ConnectWise Cloud Backup, formerly SkyKick, to sign in without authorization to Microsoft 365 environments, Huntress researchers reported. The company confirmed unauthorized sign-ins across 173 partner and customer tenants.

The backup app holds wide permissions across mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed. Researcher Jonathan Semon said the credential was used to obtain Microsoft Graph tokens from 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, with the actor moving through tenants in sorted GUID order seconds apart, suggesting a script working from a target list.

The same IP was used for password spraying against four law firm tenants on October 13 and 14, 2026, though no successful user sign-ins appeared in telemetry. In one partner tenant, a separate ConnectWise Teams app gave itself Global Administrator rights and added credentials to two other applications, including Huntress's own platform.

Todyl reported matching activity, noting that revoking sessions does not stop the access, disabling the app blocks new tokens while issued tokens remain valid for up to 90 minutes, and exposure continues until ConnectWise rotates the credential. ConnectWise has closed Cloud Backup application access until further notice and said it found no evidence partner backup data was compromised.

Recommended steps include disabling the app until credentials are reset, enabling Microsoft Graph activity logs, auditing for new credentials added since October 13, 2026, and checking Entra audit logs for ConnectWise or SkyKick apps adding themselves to directory roles.

Source: The Hackers News