Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Key Points:

• Cybersecurity researchers have identified an active campaign where threat actors are abusing a compromised ConnectWise Cloud Backup Microsoft 365 credential to access customers' M365 environments, potentially exposing mailboxes, files, Teams data, and directory information across all tenants using the app.
• The attackers used the compromised credential to obtain Microsoft Graph tokens, enabling them to perform unauthorized actions such as reading data and assigning Global Administrator privileges within affected tenants, thereby expanding their access to other trusted applications.
• ConnectWise has disabled Cloud Backup application access and is investigating the incident, while Microsoft recommends reviewing service principal sign-ins from suspicious IP addresses and monitoring for unusual credential changes or OAuth grant activity linked to the compromised app.
• Security experts advise tenants to disable the ConnectWise Cloud Backup app until credentials are reset, enable Microsoft Graph activity logging, and audit for any unauthorized changes since the breach began on October 13, 2026, due to the app’s broad permissions and lack of audit trails for some actions.
• The incident coincides with a separate supply chain attack on AOMEI Backupper software, involving brief tampering of update servers to deliver malware, highlighting ongoing threats targeting backup and recovery solutions across multiple sectors worldwide.