Compromised ConnectWise Credentials Target 173 Microsoft 365 Tenants

• •Threat actors exploited ConnectWise Cloud Backup credentials to access Microsoft 365 tenants.
• •Unauthorized sign-ins confirmed in 173 customer environments using the compromised vendor credential.
• •Organizations are advised to disable the affected application immediately to mitigate risks.

On October 15, 2026, threat actors exploited compromised credentials from ConnectWise Cloud Backup to access Microsoft 365 environments of 173 customers. The attackers used the vendor's application sign-in method, obtaining Microsoft Graph tokens from the IP address 144.172.64[.]128. This incident affects any organization with the app installed, as the credential can access all tenants where consent was granted. Huntress confirmed unauthorized sign-ins and noted that the attackers moved through tenants in a scripted manner. The compromised app has extensive permissions, allowing access to sensitive customer data. Huntress has advised impacted organizations to disable the application immediately. The situation is under close monitoring by Huntress and security partners.