A single stolen credential tied to ConnectWise Cloud Backup — the cloud backup and recovery platform formerly known as SkyKick — has been used to sign in to at least 173 Microsoft 365 tenants, according to reporting from The Hacker News. The activity highlights how much leverage a single service-provider identity can carry in the Microsoft 365 ecosystem, and why MSP-facing tooling deserves the same scrutiny as the customer environments it supports.

What Happened

Researchers are tracking an active campaign in which unknown threat actors abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup to gain unauthorized access to customers' M365 environments. The service is a cloud-based backup and recovery product built specifically for managed service providers (MSPs).

The core of the problem is architectural rather than exotic. Backup and migration platforms for M365 must be granted delegated, application-level access to customer tenants in order to read and restore mailboxes, OneDrive content, SharePoint sites, and Teams data. That access is typically established through a consent grant, after which the vendor's identity can authenticate into many customer tenants using a single set of platform credentials. When those credentials are compromised, the blast radius is not one organization — it is every tenant that has consented to the integration.

In this campaign, that is precisely what appears to have occurred: one credential, many downstream sign-ins, and 173 affected tenants identified so far.

Why MSP Tooling Is a High-Value Target

MSPs sit at the center of hundreds of customer environments, and the platforms they rely on for backup, RMM, PSA, and documentation are correspondingly attractive to attackers. A compromise at the vendor or platform layer can bypass many of the per-tenant controls customers assume are protecting them, because the access was legitimately granted in the first place.

Several factors make this class of identity especially dangerous:

  • Breadth of consent. A single integration may hold permissions across dozens or hundreds of tenants.
  • Trust by design. Sign-ins from a known backup platform are unlikely to trigger suspicion in the same way an anomalous user login might.
  • Data gravity. Backup platforms hold copies of mail and files — a rich target for data theft, extortion, or business email compromise staging.
  • Detection gaps. Activity performed through a third-party application may not surface in the same dashboards or alert rules that security teams tune for interactive user logins.

Recommended Response for MSPs and Their Customers

The most urgent priority for organizations using ConnectWise Cloud Backup, or any third-party application with delegated M365 access, is to validate the current state of that access rather than assume it is safe. Practical steps include:

  1. Review enterprise applications and consent grants in Microsoft Entra ID (Azure AD) for the backup platform and any other third-party integrations. Confirm which permissions are held and whether they remain necessary.
  2. Audit sign-in and audit logs for activity originating from the backup platform's application identity, focusing on unusual mailbox access, bulk downloads, new mailbox rules, or configuration changes.
  3. Rotate and re-issue credentials associated with the integration where the vendor advises it, and follow any guidance published by ConnectWise.
  4. Check for persistence mechanisms commonly used after M365 compromise, including inbox forwarding rules, OAuth application additions, and new or elevated accounts.
  5. Apply least privilege to third-party applications, removing consent from integrations that are no longer in active use.
  6. Notify affected customers promptly where tenant access is confirmed, in line with contractual and regulatory obligations.

The Bigger Lesson: Supply Chain Is Identity Now

This incident fits a pattern that has defined recent years of cloud intrusion: attackers increasingly target the connective tissue between organizations — vendors, MSPs, and the SaaS platforms that hold delegated trust — rather than attempting to break into each victim individually. The result is a supply chain problem expressed through identity, where a single set of credentials can function as a master key.

For defenders, that means third-party application inventory and monitoring should be treated as core security hygiene, not an afterthought. Organizations should know exactly which applications can read their mail, which identities can authenticate into their tenant without a human in the loop, and how quickly they could revoke that access if the vendor reported a compromise.

For MSPs, the stakes are compounded: an incident at a platform you depend on can become an incident for every client you serve. Incident response planning should explicitly account for vendor-side credential compromise, including pre-agreed notification channels, customer communication templates, and a tested process for revoking and re-establishing delegated access.

What to Watch

Key open questions include how the credential was obtained, whether the threat actors used the access solely for data collection or also for follow-on activity such as email fraud, and how many additional tenants may be affected beyond the 173 currently identified. Organizations should monitor advisories from ConnectWise and Microsoft for updated indicators and remediation guidance.

The full report is available at The Hacker News.