Hackers Exploit ConnectWise Backup Credential to Breach Hundreds of Microsoft 365 Tenants

Security researchers have identified an active intrusion campaign that leverages a stolen credential from ConnectWise Cloud Backup—formerly known as SkyKick—to gain unauthorized entry into at least 173 Microsoft 365 (M365) tenant environments. The findings, first reported by The Hacker News, highlight a supply‑chain style attack in which a single compromised account provides a foothold across multiple organizations that rely on the backup service.

ConnectWise Cloud Backup offers automated archiving of Exchange, OneDrive, SharePoint and Teams data for its clients. By obtaining a privileged credential associated with the backup platform, threat actors were able to authenticate directly to the Microsoft 365 admin portals of customer tenants. Once inside, the attackers could enumerate user mailboxes, download files, and potentially deploy additional payloads without triggering standard alerts.

According to the research team, the malicious actors used the stolen credential to generate Azure AD access tokens, a technique that bypasses traditional password‑based defenses. The tokens granted delegated permissions that mirrored the original backup service’s rights, allowing the intruders to move laterally within each tenant and harvest sensitive communications and documents. No specific ransomware or data‑exfiltration payloads have been publicly linked to the campaign, but the level of access suggests the potential for both espionage and extortion.

The episode underscores a broader trend of credential‑based supply‑chain threats, where attackers target third‑party services that hold privileged access to many customers. Similar incidents have involved compromised Office 365 admin accounts, SaaS management platforms, and cloud‑based identity providers. Experts stress that multi‑factor authentication (MFA), continuous token monitoring, and strict least‑privilege policies are essential controls to mitigate such risks.

In response, ConnectWise has confirmed that it is conducting an internal investigation and has reset the affected service accounts. Microsoft has issued security advisories urging all affected tenants to rotate passwords, enforce MFA for privileged accounts, and review sign‑in logs for anomalous activity. The company also recommends that organizations audit third‑party integrations and enforce conditional access policies that limit credential reuse.

Researchers continue to monitor the situation, warning that additional tenants could be targeted as the stolen credential is leveraged further. The incident serves as a reminder that even well‑intended backup solutions can become attack vectors if their authentication mechanisms are not rigorously protected. Security teams are advised to treat any unexpected access from backup services as a high‑priority incident and to collaborate closely with both the vendor and Microsoft’s incident‑response channels.