ConnectWise: steal one app secret, inherit 170 tenants
ConnectWise Cloud Backup's app secret got stolen, and attackers walked into Microsoft 365 tenants through the front door
An API secret for ConnectWise's multi-tenant backup app (formerly SkyKick) was stolen. Every Microsoft 365 tenant that had consented to the app was suddenly reachable with the permissions customers had granted it. ConnectWise suspended several cloud services.
- Disclosed
- Oct 16, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Microsoft 365 tenants using ConnectWise Cloud Backup or Cloud Management: 173 confirmed, ~1,000 touched
- microsoft-365 · entra-id
- In the wild
- Yes
- Huntress confirmed post-compromise activity in 2 tenants
The one-sentence version
The backup app already held keys to every customer's Microsoft 365; steal the app's own secret and you get all those keys at once, no phishing required.
What happened
Backup apps need wide access to your tenant: they read every mailbox, every OneDrive and every Team. In Microsoft 365 that access belongs to the vendor’s multi-tenant app. So the vendor’s app secret is a master key to every customer who clicked “Accept”.
Here, an attacker got hold of an API secret for ConnectWise’s Cloud Backup app (the former SkyKick product). They used it from the vendor’s own home tenant to request Microsoft Graph tokens for customer tenants. Six ConnectWise Cloud Management apps were abused as well. One of them gave itself Global Administrator in a customer tenant and added secrets to other apps.
Huntress saw activity in about 1,000 Entra tenants, more than 300 of them successful, and confirmed hands-on-keyboard activity in two. Whether data was stolen is unknown. Graph directory reads leave no audit trail, so “no evidence” here does not mean “nothing happened”.
Crime-scene timeline
Oct 13–14, 2026
Password spraying from the attacker's IP
Oct 14, 2026
ConnectWise discovers the issue
Oct 15, 06:13–08:34 UTC
Mass Microsoft Graph token grabs
One abused Cloud Management app (“MS Teams”) gives itself Global Administrator in a tenant and adds secrets to other apps, including Huntress's.
Oct 16, 2026
Huntress and ConnectWise go public
162 tenants confirmed by 19:00 UTC, later 173.
Oct 17, 07:00 UTC
Seven app identities disabled; Cloud Backup suspended
SaaS Security and Cloud Management are suspended as a precaution the next day.
Oct 21, 2026
Phased restoration begins
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- ConnectWise Trust CenterPrimaryDiscovered Oct 14; backup archives encrypted and isolated, no sign they were compromised
- HuntressPrimary~1,000 tenants saw attacker activity, 300+ successful, 2 with confirmed post-compromise activity
- The Hacker News173 tenants confirmed; quotes Microsoft that Directory.ReadWrite.All was likely abused
- SecurityWeekService suspension timeline