Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants
Key points
- ConnectWise has switched off its Cloud Backup service after a stolen credential let attackers sign into customers’ Microsoft 365 environments.
- Huntress confirmed unauthorised sign-ins in 162 Microsoft 365 tenants and later found almost 1,000 tenants with activity from the attacker’s address.
- ConnectWise has cancelled the credential and found no evidence stored backups were accessed, but customers cannot restore data while the service is offline.
United States-based managed service provider (MSP) software vendor ConnectWise has switched off its Cloud Backup service after attackers stole a credential that let them sign into customers’ Microsoft 365 environments.
Security firm Huntress raised the alarm over the weekend Australian time, after spotting the app signing in from a commercial hosting address the day before.
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers’ Microsoft 365 environments.
— Huntress (@HuntressLabs) October 16, 2026
Huntress confirmed unauthorised sign-ins in 162 Microsoft 365 tenants, and later found almost 1000 tenants with sign-in activity from the attacker’s address.
“The credential works against every tenant the app is consented in, so the actor is not limited to the tenants we have confirmed so far,” Huntress said.
Formerly known as SkyKick, the service is used mainly by MSPs to back up their clients’ email, files and Microsoft Teams data.
To do that, Cloud Backup needs wide access to everything it protects.
That means anyone holding its credential can reach the same live mailboxes, files and user directories in each customer’s Microsoft 365 tenant.
ConnectWise has confirmed the breach, saying it identified unauthorised access to application identities within its Cloud Backup environment.
It said it had cancelled the credential and had found no evidence that stored backups had been accessed.
However, customers cannot restore data while the service is offline.
ConnectWise also said it has no view into customer tenants, and cannot tell whether any individual customer’s Microsoft 365 environment was accessed.
It has not explained how the credential was stolen.
Huntress said a second ConnectWise app gave itself global administrator rights at one customer tenant.
After that, it added new passwords to two other apps.
One belonged to an MSP management tool and the other to Huntress itself, and both were set to last until 2028.
That would let an attacker return even after ConnectWise’s own credential was cancelled.
The security vendor said it has since found and removed the rogue credential.
Huntress also saw a separate wave of attempts against 16 tenants in the policy, national security, trade and critical minerals sectors.
Those attempts failed, as most of the targets did not use ConnectWise so the app was not present in their tenants.
As of writing, there is no attribution as to who is behind the attacks.
Huntress advised administrators to disable, not delete, the ConnectWise apps in their tenants, and to check every app for credentials added since 13 October.
Update 19/10: A spokesperson for ConnctWise told iTnews that the company has no indicators to date that Cloud Backup partner backup data has been compromised.
“As a protective measure for our partners and their clients, we are shutting off Cloud Backup application access,” the spokesperson said.
“This will interrupt backup services for customers until further notice.”
“Existing Cloud Backup archives are not impacted by this service interruption and will be accessible once services are restored,’ the spokesperson added.
“Our investigation and remediation efforts are ongoing, and we will provide updates on the ConnectWise Trust Centre.”
About Author
