Compromised ConnectWise Cloud Backup Credential Used to Access 173 Microsoft 365 Tenants

What happened

According to researchers cited by The Hacker News, an unknown threat actor is abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to customer M365 environments without authorization. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs), meaning the compromised credential appears to have provided broad reach across downstream tenants rather than a single organization. Reporting indicates the activity has touched 173 Microsoft 365 tenants so far. Details on the attacker's identity, how the credential was originally obtained, and the full scope of actions taken inside affected tenants were not disclosed in the source reporting.

Why it matters

This is a supply-chain-style exposure: a single compromised credential tied to an MSP-facing backup tool translated into unauthorized sign-ins across a large number of downstream customer tenants. Organizations that rely on MSPs for backup or cloud management inherit risk from the security posture of that MSP's own credentials and service accounts, often with limited visibility into when or how those accounts are used. Any MSP or customer organization using ConnectWise Cloud Backup should treat this as a live concern until more is known about scope and remediation.

What defenders should watch for or do now

• Review Microsoft 365 sign-in logs for authentication from ConnectWise Cloud Backup / SkyKick service accounts or associated app registrations, especially sign-ins from unexpected locations, IP ranges, or at unusual times.
• Hunt for anomalous activity following any sign-in attributed to third-party MSP or backup-service credentials, such as mailbox rule changes, new app consents, delegated permission grants, or mass data export/download activity.
• Inventory which third-party MSP tools and service accounts have standing access to your M365 tenant, and confirm least-privilege scoping where possible.
• If you use ConnectWise Cloud Backup, watch for vendor advisories and be prepared to rotate or revoke the associated credentials and tokens, and review conditional access policies covering third-party service principals.
• Enable or review alerting on sign-ins by service/app accounts that deviate from established baselines, since this type of abuse often blends into expected MSP-tool activity.

Developing story

This is net-new intelligence and details are still emerging, including full attribution, root cause of the credential compromise, and the complete list of impacted organizations. Defenders should monitor for updates from ConnectWise and Microsoft. Original source: The Hacker News.