Compromised ConnectWise Backup Credential Used to Access 173 Microsoft 365 Tenants

Huntress confirmed that threat actors exploited a stolen credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to authenticate into 173 partner and customer Microsoft 365 tenants. The backup service holds broad permissions across mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed, so the compromised credential granted the attacker equivalent access. Jonathan Semon of Huntress noted the activity originated from IP 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, with the actor iterating through tenants in sorted GUID order, consistent with scripted access from a target list. The same IP had also been used for password spraying against four law firm tenants on October 13 and 14, 2026, though no successful user sign-ins were detected. Todyl independently confirmed unauthorized Microsoft Graph authentication as the backup application, with Nicholas Koken noting that revoking user sessions would not stop the access and that already-issued tokens remain valid for up to 90 minutes.