Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
At a glance
- Severity
- Low
- Used in attacks
- No flaws named
- Vendors and products
- Microsoft
- Industries
- SaaS & technology
- Reported by
- 1 outlet
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs…
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Fastnexa security experts
Dealing with this in your own company?
If this story touches software, suppliers or systems you use, a Fastnexa security expert can tell you what it means for you and what to do first.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-17 06:16 UTC
Related stories
- Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Dark Reading · 2026-10-16
- Prolific Chinese espionage group exploits BeyondTrust zero-day
CyberScoop · 2026-10-16
- Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
The Hacker News · 2026-10-16
- UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
The Hacker News · 2026-10-16
- China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Cybersecurity Dive · 2026-10-16