ConnectWise Cloud Backup (formerly SkyKick) app credential stolen and used to pull Microsoft Graph tokens in customer M365 tenants — 162+ tenants confirmed by Huntress; ConnectWise shuts off Cloud Backup access
ConnectWise says it found unauthorised access to application identities in its Cloud Backup environment (the Microsoft 365 and Google Workspace backup service for MSPs, formerly SkyKick). Its Trust Center advisory, first posted 16 October 2026 and updated 17 October 05:01 UTC, says it has shut off Cloud Backup application access as a protective step, which interrupts backups until further notice; it has no indication so far that partner backup data was compromised and the existing backup archive is not affected. Huntress, which found the activity, says the app's Microsoft 365 credential (API secret) is in an attacker's hands: on 15 October between 06:13 and 08:34 UTC it was used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens in customer tenants, moving through tenants in sorted order a few seconds apart, which points to a script. As of 19:00 UTC on 16 October Huntress had confirmed unauthorised sign-ins in 162 tenants (The Hacker News reported 173 on 17 October), and says the credential works in every tenant where the app is consented, so any organisation with it installed is exposed. The app's consent covers mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, and some directory reads leave no audit trail. Huntress also saw the same IP password-spraying four law-firm tenants on 13 and 14 October, and in one tenant a ConnectWise Cloud Management app for Teams added itself to Global Administrator and added new secrets to an MSP management app and Huntress's own app; it has not tied that earlier activity to the same operator. Todyl separately reported the same Graph sign-ins and notes that revoking user sessions does not end app access. No country breakdown has been published. Primary: ConnectWise Trust Center advisory; research: Huntress (16 Oct); wire: The Hacker News (17 Oct).
- Product
- ConnectWise Cloud Backup (formerly SkyKick Backup) Microsoft 365 app, application ID 506e08f9-6e9a-4da4-942b-a099a03644ae; related ConnectWise / SkyKick Cloud Management apps
- Versions
- Cloud service — every Microsoft 365 tenant where the Cloud Backup app is consented
- Exploited in Australia?
- unknown
- Patch to
- In Entra admin centre, find the enterprise app 506e08f9-6e9a-4da4-942b-a099a03644ae (also listed as SkyKick or ConnectWise Cloud Backup) and set 'Enabled for users to sign-in' to No; disable rather than delete, and leave it off until ConnectWise confirms the credential is rotated. Check service-principal sign-in logs (not the default user sign-ins tab) for that app from 144.172.64.128 or anything outside Azure ranges, and review mail, file, Teams and directory activity from 13 October. Audit Entra logs for ConnectWise or SkyKick apps adding themselves to directory roles, and review client secrets and certificates added since 13 October on all enterprise apps and app registrations, especially MSP-management and security tools. Turn on Microsoft Graph activity logs. Note issued tokens stay valid up to about 90 minutes after disabling.
Primary: ConnectWise Trust Center — Cloud Backup (formerly SkyKick) service interruption advisory (16–17 Oct 2026) · Vendor: Huntress — ConnectWise (SkyKick) vendor credentials abused in M365 attacks (16 Oct 2026) · The Hacker News — Hackers use compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants (17 Oct 2026)