Scripted clients with user-agents like python-requests and curl signed into Microsoft 365 as a backup product, not as people. According to BleepingComputer, attackers abused a compromised credential for the ConnectWise Cloud Backup multi-tenant OAuth application (formerly SkyKick) to perform application-only sign-ins into customer tenants and mint Microsoft Graph access tokens. Huntress reported unauthorized sign-ins in at least about 162 tenants in its environment, with later reporting citing roughly 173. There was no interactive workforce login to challenge, fatigue, or capture in a phishing attack.
How the ConnectWise Cloud Backup app walked into tenants
ConnectWise Cloud Backup is a multi-tenant Microsoft 365 application that customers (often MSPs and IT teams) had already consented into their directories. The primary abused application ID reported publicly is 506e08f9-6e9a-4da4-942b-a099a03644ae. Additional Cloud Management apps were also abused in the same wave.
Application-only client-credential authentication is not a user sign-in. The client presents the application's own secret or certificate material and receives tokens as that service principal. No mailbox owner, no helpdesk agent, and no MFA prompt sits in that path when the secret is valid and the app is already trusted.
According to reporting on BleepingComputer, malicious activity was observed from IP 144.172.64.128 on 15 October 2026, with scripted tooling. Huntress had already linked attacker infrastructure to scripted sign-in attempts around 13-14 October 2026, including a curl/7.88.1 user agent. Microsoft identified unauthorized authentication attempts against the application identities. How the app secret itself was obtained has not been publicly established. That gap matters: the visible blast was app-as-client access, not a documented password spray against staff.
Todyl described automated Graph token acquisition that used a separate sign-in for each tenant. In nine tenants it analyzed, there was no evidence of account creation, password changes, or added permissions performed through the backup app in those cases. The first move was simpler and colder: authenticate as the consented application, take the token, move on.
| Control people expected | What ran instead | Why staff MFA never fired |
|---|---|---|
| User password + MFA | App-only client credentials | No interactive user challenge |
| Session revoke for people | Graph tokens for the app | User session kill misses app tokens |
| Partner backup trust | Pre-granted app permissions | Consent already lived in each tenant |
What consented Graph permissions actually unlocked
Because customers had already granted the backup stack broad Microsoft Graph rights, a successful app-only sign-in carried those rights with it. According to Todyl (via BleepingComputer), those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats. Directory-scoped permissions in the same class, including Directory.ReadWrite.All style grants called out in public reporting, sat in the same danger zone.
That is the supply-chain shape of this incident. The identity plane did not need a phished employee session cookie from a fake login page. It needed a live multi-tenant application credential plus permissions tenants had approved for backup and cloud management workflows.
Huntress observed service principals self-assigning directory roles after access, most often Exchange Administrator. In one tenant, a Cloud Management - MS Teams principal granted itself Global Administrator and planted credentials on other apps in about five minutes. That is post-access authorization abuse by a service principal that already held write rights into the directory, not a second human login ceremony.
Public reporting has not established a confirmed global record count or a measured exfiltration volume across every affected tenant. ConnectWise stated it had recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment. The company also said it had no indicators to date that Cloud Backup partner backup data had been compromised, and that the existing cloud backup archive was not impacted by the service interruption and would be accessible once services were restored. Those statements address archive integrity claims; they do not erase the Graph-token window inside live customer tenants while the secret worked.
What stopping the app did and did not clear
On 17 October 2026, ConnectWise shut down Cloud Backup application access at about 05:01 UTC, revoked certificates and shared credentials, and suspended the service during its investigation. Disabling the vendor application stops issuance of new tokens through that path. Existing Graph access tokens already issued remain valid until they expire. Revoking ordinary user sessions does not end application-based access. Vendor shutdown also does not automatically remove credentials already planted on other apps inside customer tenants where persistence landed.
Defenders who only reset staff passwords or force user MFA re-registration treated the wrong object. The object that authenticated was the service principal. The durable cleanup list is different: disable or remove the abused enterprise applications, rotate every secret and certificate on related app registrations, hunt for role assignments and secondary credentials created in the intrusion window, and invalidate outstanding app-only tokens and refresh material where the platform allows.
The app secret gave SSO-scale reach without any SAML cookie replay. One trusted multi-tenant app with directory-wide Graph scopes is a skeleton key across mail, files, chat, and admin roles once its secret is live. Least-privilege consent, continuous review of application permissions, and monitoring for unusual app-only token issuance from unexpected hosting IPs are the controls that sit on this path. Interactive workforce MFA never saw the request.
Other recent workforce attacks targeted people; this one targeted an application. A helpdesk password-reset social engineering path abuses people and recovery flows. An AiTM reverse-proxy campaign steals human credentials and session cookies at a fake login. Here the login subject was the application.
No threat actor has been publicly named for the ConnectWise Cloud Backup access. Full service-restoration timing beyond the initial shutdown window was not provided in early public reporting. Exact worldwide tenant counts beyond the Huntress-observed set remain unclear.
If you want the prevention-side reading of why interactive MFA was never the control that could close this app-only supply-chain path, and what actually bounds vendor secrets and consented Graph scopes, read the related article on mfa2point0.com: why MFA missed the ConnectWise SkyKick app-only token path.
FAQ
Did attackers use phishing to steal ConnectWise customers' Microsoft 365 passwords?
No. Public reporting on the ConnectWise Cloud Backup (SkyKick) incident describes application-only sign-ins using a compromised multi-tenant OAuth app service-principal credential, not workforce users typing passwords on a spoofed page. According to BleepingComputer's coverage of Huntress, Microsoft, Todyl, and ConnectWise statements, the client authenticated as the backup application and received Microsoft Graph tokens with permissions customers had already consented.
Why did user MFA not stop the ConnectWise SkyKick tenant access?
User MFA did not stop the ConnectWise Cloud Backup tenant access because the sign-ins were application-only. There was no interactive employee authentication step for a push, OTP, or passkey ceremony to gate. A valid stolen app secret authenticates as the already-consented service principal, so staff MFA never entered the request path.
How many Microsoft 365 tenants were affected?
Huntress reported unauthorized sign-ins in at least about 162 compromised tenants in its environment, and later public reporting cited roughly 173. A complete global victim count beyond those observed sets has not been established in the sources available at disclosure. Confirmed bulk record-exfiltration totals also remain unreported.
What could attackers do after the app-only Graph tokens were issued?
After app-only Graph tokens were issued in the ConnectWise Cloud Backup incident, the tokens carried permissions tenants had already granted the application. According to Todyl via BleepingComputer, that meant technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats. Huntress also saw directory role self-assignment, commonly Exchange Administrator, and in one tenant a roughly five-minute path to Global Administrator plus credential planting on other apps.
Does disabling the ConnectWise Cloud Backup app end every attacker session immediately?
Disabling the ConnectWise Cloud Backup application stops new token issuance through that app path, but existing Graph tokens can remain valid until expiry. Revoking user sessions does not terminate application-based access. Credentials already planted on other applications inside customer tenants also remain until customers remove them. ConnectWise reported no indicators that partner backup archives were compromised, which is a separate claim from live Graph access during the intrusion window.
