ConnectWise credential abuse exposes 173 Microsoft 365 tenants

Threat actors used a compromised credential for ConnectWise Cloud Backup, formerly SkyKick, to sign in to 173 Microsoft 365 partner and customer tenants, security firm Huntress said. The credential allowed the actors to obtain Microsoft Graph tokens in tenants where the backup application had been consented.

ConnectWise Cloud Backup is used by managed service providers to back up and recover Microsoft 365 and Google Workspace data. To perform that role in Microsoft 365, it can be granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory information. ConnectWise has closed Cloud Backup application access until further notice and said it has found no evidence that partner backup data was compromised.

Token access followed the application's existing consent

Huntress identified token activity from 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC. Researcher Jonathan Semon said the actor progressed through tenant GUIDs in sorted order, only seconds apart, a pattern consistent with a script operating from a target list.

The attackers authenticated to the application with their own tooling in a manner analogous to the backup service and obtained tokens carrying the app's existing permissions. That means the effective exposure varies by tenant configuration, but can include the data the backup product is allowed to read.

Todyl separately detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application. Its analysis said the inherited consent may permit read and write access to mail and attachments through Exchange Web Services, OneDrive and SharePoint files, Teams chats, and data restoration functions.

Privilege changes can extend the exposure

Huntress also found, in at least one partner tenant, a separate ConnectWise app assigning itself the Global Administrator role and adding credentials to other trusted applications. The ConnectWise Cloud Management app for Microsoft Teams, identified as application ID 24205314-2b89-4e07-a2a4-579e898a5640, then used a Python script with the user agent Python-urllib/3.12 to add client secrets to an MSP management application and the Huntress Security Platform application.

Those changes matter because privileged management applications may be consented across an MSP's customer tenants, while a credential added to a security application can carry whatever permissions that tool has. Huntress noted that some directory reads through Microsoft Graph may leave no audit trail, making the scope of access difficult to establish solely from evidence of data use.

What administrators should check

ConnectWise and the researchers advise disabling the application until ConnectWise confirms that credentials have been reset. Disabling it prevents new tokens from being issued in a tenant, although Todyl said tokens already issued can remain valid for up to 90 minutes; revoking user sessions alone does not end the application access.

• In Microsoft Entra Admin Center, review Service principal sign-ins, rather than only the default user sign-ins view.
• Filter sign-in logs for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and investigate activity outside expected Microsoft or Azure ranges, including 144.172.64[.]128.
• Enable Microsoft Graph activity logs, audit credentials added since October 13, 2026, and inspect Entra audit logs for ConnectWise or SkyKick applications assigning directory roles.

For MSPs and their customers, the immediate business implication is to treat consented backup applications as high-privilege identities: suspend affected access, preserve and review service-principal evidence, and verify that trusted applications have not acquired new credentials or directory roles.