ConnectWise Cloud Backup (formerly SkyKick) attack hits Microsoft 365 tenants: what to review in your third-party apps

Between October 15 and 17, 2026, a supply-chain attack hit companies that use ConnectWise Cloud Backup (formerly SkyKick Cloud Backup), a Microsoft 365 and Google Workspace backup service built for managed service providers (MSPs). According to BleepingComputer, attackers used the backup app’s own credential to get into customers’ Microsoft 365 tenants, without any user’s password and without passing MFA.

In ConnectWise’s latest update, on October 19, 2026, the service was still suspended: scheduled backups, archive access, and restores were unavailable, with no restoration date yet.

The case matters even if you don’t use this product, because it shows how a third-party app with broad Microsoft 365 permissions can become a way in.

What happened

• In its security advisory published on October 16, ConnectWise said it had identified unauthorized access to application identities in the Cloud Backup environment and shut down those apps’ access.
• Huntress reported that on October 15 the backup app’s identity signed in to customer tenants from a hosting provider’s address and received Microsoft Graph access tokens. By the afternoon of October 16, it had confirmed unauthorized sign-ins in 162 tenants. In a later update, it said it had found almost 1,000 tenants with sign-in activity from that address, more than 300 of them successful.
• Huntress also saw ConnectWise management apps assigning themselves administrative roles in about 50 tenants, mostly Exchange Administrator. It has not confirmed whether that part was the attacker or the vendor’s own automation. In one tenant, however, one of those apps gave itself Global Administrator and added new credentials to two other apps, a way to keep access even after the original credential is revoked.
• According to BleepingComputer, Microsoft also confirmed the malicious activity and described it as an active supply-chain attack.
• On October 17, ConnectWise disabled seven application identities and revoked the associated credentials. The company says it has no indication that backup data was compromised and that archives remain encrypted and isolated. It also warns that tokens already issued may stay valid until they expire.

It is still unknown how the vendor credential was obtained or how much data was accessed.

Why MFA didn’t stop it

A backup app has to read and write mail, OneDrive and SharePoint files, and Teams chats to make copies and restore them. For that it gets broad permissions in Microsoft Entra ID and signs in as an application, with no user involved.

Whoever holds that app’s credential inherits the same permissions in every tenant where it is installed. Because no person signs in, MFA and user-focused policies never come into play.

What to do now if you use ConnectWise or SkyKick

These steps summarize what ConnectWise published in its investigation and remediation guide and what Huntress recommends:

1. In the Microsoft Entra admin center, under Enterprise applications, find the ConnectWise and SkyKick apps (older tenants may list them as “SkyKick Cloud Manager”) and disable sign-in without deleting them. Deleting removes consent, which you would have to grant again later.
2. Keep them disabled until ConnectWise publishes formal restoration instructions.
3. Review service principal sign-ins (that tab, not the default user sign-ins tab) for addresses outside Microsoft’s ranges.
4. Review secrets and certificates on all apps in the tenant, especially management and security tools, and remove any added since October 13 that you didn’t create. Disabling the ConnectWise app does not remove credentials already planted on other apps.
5. Check whether any ConnectWise or SkyKick app holds directory roles you didn’t grant, and remove them.
6. Review Conditional Access exclusions that include these apps.
7. Remember that while the service is down there are no new backup points. Decide whether that gap is acceptable or whether you need a temporary alternative copy.

If an MSP runs your IT, ask them directly whether they use these products and whether they have reviewed your tenant. ConnectWise stresses that reviewing the MSP’s tenant is not the same as reviewing each customer’s tenant.

What every company on Microsoft 365 can review

Even without ConnectWise, it’s worth looking at the third-party apps connected to your Microsoft 365:

• Inventory: which third-party apps have consent in your tenant today? Has any been sitting there unused for years?
• Permissions: does each one have only the access it needs? Does any hold administrative roles?
• Credentials: who can add secrets and certificates to apps? Huntress recommends limiting who holds the Application Administrator and Cloud Application Administrator roles.
• Policies: app management policies can restrict secrets and cap their lifetime, and Conditional Access for workload identities (which needs additional licensing) can limit where an app signs in from.
• Monitoring: is anyone watching app sign-ins and alerts such as an app assigning itself a role?
• Backup: if your backup service went down for days, is there a plan B? How long can your business go without new restore points?

Not every item applies to every environment. What matters is being able to answer these questions before the next incident.

How CGT can help

CGT supports small and mid-sized businesses with IT management, security, and Microsoft 365, within the scope agreed with each client: reviewing apps and permissions in Entra ID, following security alerts, and planning backup.

Want to know which apps have access to your company’s Microsoft 365? Meet CGT and talk to us.

Sources: BleepingComputer, Oct 17, 2026, updated Oct 18, ConnectWise security advisory, ConnectWise investigation and remediation guide, and Huntress analysis.