As reported by The Hacker News, threat actors have compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick), using it to authenticate into at least 173 customer tenants via Microsoft Graph. The incident, disclosed by Huntress on October 17, 2026, underscores a persistent and dangerous blind spot in cloud identity architecture: service principals with tenant-wide consent are third-party risk incarnate.
Why This Attack Pattern Is So Dangerous
ConnectWise Cloud Backup is granted extensive permissions across mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it's installed. When the application's credential was compromised, the attacker didn't need to phish a single user—they simply authenticated as the app and pulled Microsoft Graph tokens with all the permissions the backup service already held. This is the OAuth supply chain attack model in its purest form.
The app's credential is in hostile hands. It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.
The attacker moved through tenants in sorted GUID order at seconds-apart intervals, strongly indicating automated scripting against a prebuilt target list. This wasn't opportunistic—it was systematic.
The Escalation: Credential Injection Into Trusted Apps
What elevates this incident from a read-only data exposure to a full-blown identity crisis is the secondary activity Huntress discovered. In at least one partner tenant, a separate ConnectWise app—Cloud Management for Microsoft Teams (App ID: 24205314-2b89-4e07-a2a4-579e898a5640)—elevated itself to Global Administrator and then added new client secrets to two other privileged applications: an MSP management platform and Huntress's own security tool. This means the blast radius extends well beyond ConnectWise. Any trusted app that shared a tenant with the compromised service principal is now a potential pivot point.
Adding credentials to an existing application registration is one of the most under-monitored privilege escalation techniques in Entra ID. If an attacker holds a client secret for a highly privileged app, they can authenticate indefinitely—even after the original compromise is remediated—unless those rogue credentials are explicitly discovered and removed.
Who Is at Risk
Shield53 Recommendations
Immediate Actions:
- Audit ConnectWise app registrations: Search Entra ID for all applications matching ConnectWise or SkyKick identifiers. Review sign-in logs for tokens issued from 144.172.64.128 or any unexpected IP between October 13–17, 2026.
- Revoke all client secrets and certificates: For every ConnectWise-related service principal in your tenant, remove existing credentials and reissue them through a controlled process after confirming the app is still needed.
- Check for rogue credentials on ALL privileged apps: Do not limit your investigation to ConnectWise. Inspect every application registration with elevated permissions—especially Global Admin or full Graph scopes—for client secrets or certificates you did not create.
- Review consent grants: Enumerate all OAuth grants in the tenant. Remove any that are unnecessary, and reduce remaining grants to least privilege. Use Microsoft's
Get-AzureADServicePrincipalOAuth2PermissionGrantor the Graph API equivalent. - Enable conditional access for service principals: Restrict app token issuance to known IP ranges where possible. Microsoft now supports named locations and conditional access policies scoped to workload identities.
- Notify downstream customers: If you are an MSP, proactively notify every client tenant where ConnectWise Cloud Backup is installed and guide them through credential rotation and audit procedures.
Strategic Guidance:
This incident is the latest in a pattern of supply chain compromises via third-party SaaS integrations. Organizations must treat every OAuth-connected application as a privileged identity that requires the same governance rigor as a human administrator. That means inventory, least-privilege consent, continuous monitoring of credential changes, and an incident response playbook specifically for service principal compromise. The era of granting blanket tenant-wide permissions to backup tools and management platforms without compensating controls is over.
