Key points
- Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants using a compromised ConnectWise Cloud Backup credential.
- The attacker used an application-only identity, bypassing user passwords and multi-factor authentication prompts entirely.
- Microsoft Threat Intelligence is tracking this active supply chain attack involving the ConnectWise Cloud Backup service, formerly known as SkyKick.
ConnectWise Cloud Backup, previously known as SkyKick Backup, is the affected product in this incident. According to Microsoft Threat Intelligence, an active supply chain attack is underway involving this service. Huntress, a cybersecurity firm, confirmed that an API secret belonging to the vendor was compromised. This credential allowed attackers to sign in to 173 Microsoft 365 partner and customer tenants. The breach impacts every organization that has installed this application and granted it consent within its environment.
In plain English
The ConnectWise Cloud Backup service requires broad permissions to protect data. It accesses mailboxes, OneDrive files, SharePoint sites, Teams data, and directory information. Because the application is trusted, it can perform these tasks without user intervention. Attackers stole the vendor’s API secret, which is like a master key for the application. They used this secret to generate access tokens for customer tenants. This allowed them to read and potentially exfiltrate data that the backup service was authorized to see.
View the original post on X
The background
The attack occurred on October 15, 2026. According to Huntress researcher Jonathan Semon, the attacker signed in from IP address 144.172.64[.]128 between 06:13 and 08:34 UTC. The activity involved the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. The attacker moved through tenant identifiers in sorted order, with only seconds between each login. This pattern suggests an automated script working from a prepared target list. The logins used client assertions, meaning the secret originated from the vendor’s tenant, not from individual customer actions.
What changes now
In at least one Huntress partner tenant, the attacker escalated privileges. A different application, ConnectWise Cloud Management – MS Teams (ID 24205314-2b89-4e07-a2a4-579e898a5640), assigned itself the Global Administrator role. It then used a Python script to add new client secrets to two other trusted applications. These new secrets are set to expire in 2028. Disabling the original ConnectWise apps does not remove these planted credentials. Defenders must review all app secrets and certificates, not just those associated with ConnectWise, to prevent future access.
Who needs to act first
Organizations using ConnectWise Cloud Backup should immediately review their Microsoft 365 application registrations. Teams usually prioritize checking for unauthorized app permissions or unexpected administrative role assignments. Check whether any new client secrets or certificates have been added to trusted applications recently. While no vendor fix exists yet, reducing exposure requires auditing all app identities, not just the compromised one. Back up critical configuration data before making changes to app permissions. Verify that no other applications have been granted Global Administrator privileges without explicit approval.
What to do and how to stay safe: ConnectWise
- Review Microsoft 365 sign-in logs for activity from the ConnectWise Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
- Audit all application registrations for unauthorized client secrets or certificates, especially those expiring in 2028.
- Verify that no applications other than ConnectWise Cloud Management – MS Teams have recently been assigned the Global Administrator role.
- Monitor for unusual access patterns, such as rapid sequential logins from a single IP address or automated script behavior.
Step-by-step guide: Phishing Risks and Protection for Small Business Operations
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this affect users who do not use ConnectWise Cloud Backup?
No, the incident only impacts organizations that have installed and consented to the ConnectWise Cloud Backup application in their Microsoft 365 tenant.
Did the attacker use stolen user passwords to gain access?
No, the attacker used a compromised vendor API secret to authenticate as the application itself, bypassing user passwords and multi-factor authentication.
Is there a patch or update available to fix this vulnerability?
No fix has been confirmed yet. The issue stems from a compromised credential, not a software bug, so standard patching may not resolve the exposure.
