Hackers Abuse Compromised ConnectWise Credential to Access 173 Microsoft 365 Tenants

Cybersecurity researchers have issued an alert regarding an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly known as SkyKick. The credential is being used to sign in to customer Microsoft 365 environments, with at least 173 tenants reported as affected.

ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs). The attackers appear to be using the legitimate service credential to gain unauthorized access, a technique that can bypass initial security barriers by leveraging trusted accounts.

The exact threat actor group behind the campaign has not been identified. Researchers note that the full scope of data exfiltration, configuration changes, or lateral movement within the compromised organizations is still under investigation. The reported figure of 173 affected tenants is based on researcher analysis and remains unverified pending further official advisories.

Mitigation recommendations include credential rotation, enabling multi-factor authentication, monitoring for anomalous sign-in activity, and reviewing M365 tenant permissions and backup configurations.