Skip to content
SaaS Supply Chain Attack Targets Microsoft 365 via Stolen Credentials

SaaS Supply Chain Attack Targets Microsoft 365 via Stolen Credentials

First seen 26 Oct 2026, 11:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 14:42 UTC
  • •Attack attributed to Storm-0940, a China-state-aligned actor.
  • •Utilized 'tenant spray' technique to bypass MFA and Conditional Access.
  • •Nearly 1,000 Entra tenants targeted, with a focus on IT and legal sectors.

In October 2026, a supply chain attack exploited stolen credentials from ConnectWise and Atera to access Microsoft 365 tenants. The threat actor, identified as Storm-0940, a China-state-aligned group, employed a technique called 'tenant spray' to request OAuth tokens from numerous organizations, including those without the compromised apps installed. This attack method bypassed traditional security measures like multi-factor authentication (MFA) and Conditional Access by using app-only authentication flows. Nearly 1,000 Entra tenants were probed, particularly in the IT and legal sectors. The campaign also involved password spraying against Okta and Entra ID tenants. The attack's infrastructure consisted of four IP addresses registered to Frantech Solutions, which had no prior telemetry. The incident highlights vulnerabilities in multi-tenant SaaS integrations, posing risks to a broad range of organizations. The findings were corroborated by an Obsidian Security report published on October 23, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Microsoft attributes attack to Storm-0940
Microsoft confirmed the attack was linked to the China-state-aligned actor Storm-0940.
www.obsidiansecurity.com
2026-10-23
Obsidian Security report published
Obsidian Security released findings detailing the attack methodology and its impact on SaaS integrations.
Rescana
2026-10-26
Active exploitation alert issued
An alert was issued regarding the ongoing exploitation of the vulnerabilities in the SaaS ecosystem.
Rescana

More articles in this cluster (2)

Following this threat?

Track Storm-0940 and ConnectWise in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

Which organizations are affected?
Organizations using Microsoft 365 with integrations to ConnectWise and Atera are at risk.
How can we protect against this attack?
Implement stricter access controls and monitor for unusual authentication attempts across SaaS applications.
Is there a patch available?
The articles do not mention specific patches; focus on monitoring and access control improvements.