Compromised ConnectWise credential reached 173 Microsoft 365 tenants

Huntress said it had confirmed unauthorised sign-ins in 173 partner and customer tenants through a compromised ConnectWise Cloud Backup credential. Jonathan Semon said the credential was used to obtain Microsoft Graph tokens from 144.172.64[.]128 on 15 October 2026, between 06:13 and 08:34 UTC, and that the pattern suggested scripted targeting.

Huntress said the app's permissions let an attacker reach mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it was installed and consented. Todyl said it had seen an unauthorised party authenticate as the same app, and Nicholas Koken said revoking user sessions would not stop already issued tokens.

Huntress said a separate ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role in one partner tenant and then changed two other applications by adding new client secrets. Semon said that could widen access beyond a single tenant because MSP tools are often consented into customer environments.

ConnectWise said it had shut off Cloud Backup application access while its investigation and remediation continued, and said it had found no evidence that partner backup data had been compromised. Microsoft said it was tracking the attack and told defenders to review service principal sign-ins, app credential changes and OAuth grants.

In a separate development, Google's Mandiant, Google Threat Intelligence Group and ManageEngine Threat Analysis Lab said they had seen brief tampering of AOMEI Backupper update infrastructure between April and July 2026. They said the changes redirected downloads to a malicious ZIP file that delivered CROSSROAD and SHINYROAD, and they attributed the campaign to UNC7017.