HACKERS have exploited a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign into 173 Microsoft 365 tenants, gaining broad access to customers’ data across mail, OneDrive, SharePoint, Teams and directory information. The campaign hinges on the vendor’s Cloud Backup app having extensive permissions in every tenant where it is installed, so whoever holds the token can read and potentially restore data within those tenants.
Evidence from Huntress shows unauthorized sign-ins using the app’s access tokens occurred in 173 partner/customer tenants between 06:13 and 08:34 UTC on 15 October 2026, with the attacker moving across tenants in GUID order, suggesting a scripted process targeting a known list.
In at least one observed case, the attacker manipulated a ConnectWise app to grant itself Global Administrator privileges and added credentials to other trusted apps, thereby broadening the access beyond the immediate vendor account. The interaction enabled the attacker to affect MSP and security tools within a tenant, including adding client secrets to rival applications, which could extend access across multiple tenants where those tools are installed.
Authorities note that revoking user sessions does not terminate ongoing access, and tokens issued prior to credential rotation can remain valid for up to 90 minutes.
ConnectWise has paused Cloud Backup app access pending credential resets and has not found evidence of backup data exfiltration. The firm issued guidance to review sign-in logs (Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae in Entra), monitor for abnormal IPs such as 144.172.64[.]128, and audit for new credentials or directory-role changes linked to ConnectWise or SkyKick apps. Users are advised to disable the app until credentials are rotated and activity logs are thoroughly reviewed.