ConnectWise Cloud Backup app abused to breach M365 tenants

Attackers abused the Microsoft 365 app identity of ConnectWise Cloud Backup, formerly SkyKick Cloud Backup, to sign in to customer tenants from October 15, 2026. A tenant is one organization's own Microsoft 365 setup. Security firm Huntress confirmed unauthorized sign-ins in at least 162 of them. Because the attacker logged in as a trusted app rather than as a person, multi-factor authentication (MFA) never came into play.

Microsoft called it an active supply-chain attack, BleepingComputer reports. In a supply-chain attack, intruders get in through a vendor their targets trust. ConnectWise sells its tools mostly to managed service providers (MSPs), firms that run IT for many smaller businesses.

How the attack worked

Backup apps need wide access, so customers grant them broad permissions in Microsoft Entra ID, Microsoft's identity service. The app then has its own identity, called a service principal, that can sign in without a human.

The attacker used the backup app's own credential to request access tokens and call Microsoft's Graph API with the permissions customers had already granted. The researchers describe the credential differently. Huntress calls it a client assertion, while Todyl, another security firm, says a client secret was used.

Some of ConnectWise's Cloud Management apps then gave themselves admin roles, "mostly Exchange Administrator," Huntress found. In one tenant, the Teams Cloud Management app made itself Global Administrator. It also added credentials to two other apps, one of them Huntress's own.

Timeline

Date (2026, UTC)	What happened
October 13-14	Password spraying hit four law-firm tenants, per Huntress
October 14	ConnectWise says it identified the issue
October 15, from 01:58	Malicious sign-ins and role changes began, per Huntress
October 16, 17:47	ConnectWise published its first advisory
October 16, 19:00	Huntress confirmed sign-ins in 162 tenants
October 17	ConnectWise disabled seven app identities and suspended Cloud Backup
October 18, 01:00	Cloud Backup still suspended, with no restore time given

The count kept growing. In an October 17 update, Huntress said almost 1,000 Entra tenants had seen sign-in attempts from the attacker's IP address, and more than 300 had succeeded. No one has named the attacker. Huntress traced the activity to a hosting-provider address, 144.172.64[.]128.

What data was at risk

The permissions customers granted let the backup app read and write mail, OneDrive and SharePoint files, and Teams chats, Todyl says. In the nine tenants Todyl examined, it found only sign-ins, not proof of data theft. Huntress has also not confirmed any mail or file access. It warns that reading the directory leaves no trace in audit logs.

"We have no indicators to date that Cloud Backup partner backup data has been compromised," ConnectWise said in its advisory. It has also taken its SaaS Security and Cloud Management services offline as a precaution.

What this means for developers

• Disable the ConnectWise apps, do not delete them. Huntress advises disabling the affected enterprise apps in each tenant. Deleting removes the consent and makes later investigation harder. Older tenants may list them as "SkyKick Cloud Manager."
• Remember that tokens outlive the switch-off. Tokens already issued stay valid until they expire, up to 90 minutes, Todyl says. Revoking user sessions does not end an app's access.
• Hunt for new credentials and roles. Review client secrets and certificates added since October 13. Check Entra audit logs for apps that added themselves to roles, and remove any unexpected Global Administrator rights.
• Do not turn backups back on early. "Do not re-enable affected ConnectWise applications until ConnectWise confirms all credentials have been reset," Huntress says. Disabling pauses backups but does not delete the copies ConnectWise already holds.
• Audit every app with broad consent. This attack needed no stolen password and passed MFA. Any third-party app with tenant-wide mail or file permissions is the same kind of door. List those apps, cut permissions they do not need and limit who can manage them.