ScamWatch USA
Log in
Back to Scam Alerts
CRITICAL THREAT · Cybersecurity Incident

ConnectWise Cloud Services Suspended Following M365 Tenant Compromise

ConnectWise has suspended several cloud services, including Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management, following the discovery of unauthorized access to its application identities. Attackers leveraged compromised vendor credentials to gain unauthorized access to 173 Microsoft 365 (M365) tenants.

10/21/2026Microsoft 365ConnectWise Cloud BackupConnectWise SaaS SecurityConnectWise Cloud Management

Warning signs

  • Unauthorized sign-ins to Microsoft 365 tenants associated with ConnectWise application IDs
  • Unexpected changes to Global Administrator roles within M365 environments
  • Presence of unknown or unauthorized client secrets in MSP management applications
  • Suspicious activity originating from IP address 144.172.64.128

What you should do

  • Review Microsoft 365 sign-in logs for service principal activity dating back to October 13, 2026
  • Audit all service principals and OAuth applications for unauthorized permissions or elevated roles
  • Follow the official ConnectWise technical investigation and remediation guide for specific cleanup steps
  • Rotate credentials for any accounts or applications identified as potentially compromised
  • Monitor the official ConnectWise Trust Center for ongoing updates and security advisories
In mid-October 2026, ConnectWise identified that unauthorized actors were abusing compromised application identities associated with its Cloud Backup service. These credentials, which possessed broad permissions, allowed attackers to access M365 environments, including mailboxes, OneDrive, SharePoint, and directory data. In some instances, the attackers attempted to escalate privileges by assigning the application Global Administrator roles and planting malicious secrets. ConnectWise officially disabled seven affected application identities on October 17, 2026, and has provided technical guidance for administrators to audit their environments for signs of compromise.

Sources

https://status.connectwise.com/https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.htmlhttps://www.huntress.com/blog/vendor-credential-enables-unauthorized-accesshttps://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdfhttps://www.cyberverso.net/brief/cyber-brief-20-oct-2026