One ConnectWise app credential opened Microsoft 365 tenants across MSP customers
Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens in 162 tenants by October 16 and using a Cloud Management app to grant itself Global Administrator. ConnectWise has disabled seven app identities.
Huntress reported on October 16 that an attacker was authenticating as the ConnectWise Cloud Backup application (formerly SkyKick) in Microsoft Entra ID tenants with the app's own credential, which works in every tenant that consented to it. Between 06:13 and 08:34 UTC on October 15, the attacker obtained Microsoft Graph tokens from 144.172.64[.]128; Huntress confirmed unauthorized sign-ins in 162 tenants by that evening, a count The Hacker News put at 173 a day later. In one tenant the ConnectWise Cloud Management Teams app added itself to Global Administrator and planted new client secrets on two other apps, one of them Huntress's own. ConnectWise disabled seven app identities on October 17 and suspended Cloud Backup. It has not said how the credential was exposed.
Why it matters
A multi-tenant app is a single credential with access to every customer that clicked "consent". The attacker needed no user, no password and no MFA prompt: the service principal already held mail, files and directory write permissions. Todyl warned that revoking user sessions does nothing here, and tokens already issued stay valid after the app is disabled.
If you or your MSP used SkyKick or ConnectWise Cloud Management, disable (do not delete) the listed app IDs, starting with 506e08f9-6e9a-4da4-942b-a099a03644ae. Check the "Service principal sign-ins" tab, not the default user view, from October 13 on. Audit every app registration for secrets or certificates added since then, and remove any directory role you did not grant. Longer term, cap app secrets with app management policies, put Conditional Access on workload identities, and review third-party consents as non-human identities with owners and expiry.
Update, October 28, 2026: Microsoft attributed the campaign to Storm-0940 on October 21 and counted sign-in attempts on more than 2,250 tenants. It advises keeping the affected apps disabled until ConnectWise publishes restoration steps and reviewing service principal sign-ins, including failures, back to October 1, earlier than the October 13 start given above. Details are in our follow-up, Storm-0940 used ConnectWise app identities to reach 2,250 Microsoft 365 tenants.
Source: Huntress
Related on Start with Identity
- BlogGitLab's incoming email address is a non-expiring token that commits code and runs CI as you
Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and ca
- BlogAuthMask flaw let any Android app pull work-account tokens from Microsoft Authenticator
Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and r
- BlogHuntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password
Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, r
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.