<![CDATA[Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants]]>Researchers are tracking an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs).

According to the reporting, the stolen credential was used to sign in to 173 Microsoft 365 tenants. Because the service is designed for MSPs, a single compromised credential can potentially expose the environments of many downstream customers at once, which is what makes this campaign notable.

Key points from the report:

  • The credential belongs to ConnectWise Cloud Backup, previously known as SkyKick.
  • Attackers used it to authenticate into customer Microsoft 365 environments.
  • Sign-ins were recorded across 173 tenants.
  • The actors behind the campaign remain unknown.
  • No specific CVE ID or advisory identifier was provided in the source report.

If your organization uses ConnectWise Cloud Backup or works with an MSP that does, it is worth reviewing tenant sign-in logs and auditing access associated with the service. No formal mitigation guidance beyond that was included in the reporting.

Source: The Hacker News

Does your organization rely on ConnectWise Cloud Backup or an MSP that does, and have you checked your tenant logs since this report?

]]>https://xploitlk.com/topic/717/hackers-use-compromised-connectwise-credential-to-sign-in-to-173-microsoft-365-tenantsRSS for NodeTue, 27 Oct 2026 07:52:01 GMTSat, 17 Oct 2026 08:30:21 GMT60