Hackers use a stolen ConnectWise Cloud Backup (formerly SkyKick) credential to sign into multiple Microsoft 365 environments. Researchers report the activity occurred on October 15, 2026, when the attackers used the credential to authenticate to 173 Microsoft 365 tenants, effectively gaining unauthorized administrative access.
Outlets describe this as a likely supply-chain compromise: the attackers access or abuse application identities associated with ConnectWise’s cloud backup service, then pivot into customer Microsoft 365 tenants. Bleeping Computer reports ConnectWise shuts down customer access to its Cloud Backup service after detecting the issue, while researchers in other coverage frame the event as an active campaign and issue an alert to organizations that use the service. The articles emphasize that the root cause involves compromised identities tied to ConnectWise Cloud Backup, and the impact is measured by the number of Microsoft 365 tenants reached.
The reporting focuses on the scope of unauthorized sign-ins and the response by ConnectWise to limit access, alongside warnings for affected customers to review authentication activity and incident traces.
