Hackers used compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants

On October 15, 2026, Huntress observed confirmed unauthorized sign-ins using a compromised ConnectWise Cloud Backup credential in 173 Microsoft 365 tenant environments.

By navigating tenants in sorted GUID (globally unique identifier) order with only a few seconds between each, the attacker showed signs of automation using a script based on a target list. On October 13 and 14, 2026, the attacker used the same IP address to spray passwords against four law firm tenants, but Huntress found no successful sign‑ins.

Within a single partner tenant, the ConnectWise Cloud Management application took on Global Administrator privileges for itself. It also added new client secrets to the Huntress Security Platform application and to the MSP management application, granting the attacker the inherited privileges of those trusted tools and possibly allowing access beyond the single tenant.

Todyl observed an unauthorized sign-in to Microsoft Graph that appeared to come from the ConnectWise Cloud Backup application. The authentication inherited the app’s existing consent, granting read/write access to mail, OneDrive, SharePoint, Teams and directory data.

If a tenant disables the ConnectWise Cloud Backup application, it halts new token issuance, though any tokens already issued stay valid for as long as 90 minutes. ConnectWise responded by closing Cloud Backup application access pending further investigation and stated it found no evidence that attackers had compromised partner backup data.

ConnectWise provided indicators of compromise, including filtering Service principal sign‑ins (Azure AD authentication tokens) by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and reviewing sign‑in logs for IP 144.172.64.128 outside expected Azure ranges. ConnectWise advises users to disable the ConnectWise Cloud Backup application until ConnectWise resets all compromised credentials. Users should enable Microsoft Graph activity logs and audit for any new credentials added since October 13, 2026. They should also check Entra audit logs (Microsoft’s identity and access management platform) for role additions made by ConnectWise or SkyKick applications.