Compromised ConnectWise Cloud Backup Secret Gave Attackers Access to 300+ Microsoft 365 Tenants

ConnectWise Cloud Backup, a hosted service formerly sold as SkyKick that copies Microsoft 365 mail, files and Teams data for managed service providers, had an application secret stolen and used to sign in to customer tenants as the backup service. Huntress confirmed unauthorized sign-ins in 162 tenants on October 16, 2026, and later counted nearly 1,000 Entra tenants with sign-in activity from the attacker's address, more than 300 of them successful. Some service principals for ConnectWise Cloud Management applications also assigned themselves directory roles, mostly Exchange Administrator, and in one tenant an application granted itself Global Administrator. Because the attackers authenticated with the application's own secret rather than a user login, multi-factor authentication did not apply, and ConnectWise has shut down application access while stating it sees no sign partner backup data was compromised. Containment requires auditing every secret on each affected enterprise application, since credentials added by the attackers remain valid even after the applications are disabled.