Hackers Use Compromised Connect Wise Credential to Sign In to 173 Microsoft 365 Tenants
Summary: Unknown threat actors used a compromised ConnectWise Cloud Backup (formerly SkyKick) credential to obtain Microsoft Graph tokens in customer tenants from IP 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC, with Huntress confirming unauthorized sign-ins in 173 partner and customer tenants. The actor moved through tenants in sorted GUID order seconds apart, and in at least one partner tenant a separate ConnectWise app added itself to the Global Administrator role and added new client secrets to two other privileged applications.
What's compelling: The backup app's broad consent means whoever holds its tokens can read mailboxes, OneDrive and SharePoint files, Teams data and directory information across every tenant where it is installed, and directory reads through Microsoft Graph leave no audit trail. Tokens already issued stay valid for up to 90 minutes after the app is disabled, so any tenant where it remains enabled stays exposed until ConnectWise rotates the credential.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026