A compromised Microsoft 365 application credential belonging to ConnectWise Cloud Backup, formerly SkyKick Backup, was used to obtain Microsoft Graph tokens in customer tenants. Huntress had confirmed 162 unauthorized sign-ins by 19:00 UTC on October 16, 2026; an October 17 managed-service-provider update reported 173 affected partner and customer tenants. The total was still changing as investigations continued.
This is an application-identity incident, not simply a stolen-user-password event. Multi-factor authentication on employee accounts does not invalidate tokens issued to the compromised vendor application. Administrators should disable the affected service principals, investigate Entra logs, remove unauthorized roles and credentials, and wait for ConnectWise to confirm vendor credential rotation before restoring service.
As an Amazon Associate I earn from qualifying purchases.
What happened in the Microsoft 365 incident
Huntress reported that an API credential for the ConnectWise Cloud Backup application was compromised. The secret was held in the vendor’s own tenant, so a customer could not have created the resulting authentication event. Attackers used the credential to obtain Microsoft Graph access tokens in customer Microsoft 365 tenants where the application had already received consent.
Recommended Free Tools
Those tokens could act with the permissions granted to the backup application. Depending on each tenant’s consent and configuration, that may include access to Exchange mailboxes, OneDrive files, SharePoint content, Teams data and directory information. Huntress described the event as unauthorized access to customers’ Microsoft 365 environments and warned that disabling an app does not remove credentials attackers may have added elsewhere.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
The first observed activity was on October 15, when Huntress saw the ConnectWise Cloud Backup application authenticate from 144.172.64.128, an address associated with a hosting provider, and receive Microsoft Graph tokens. The incident advisory is available from Huntress.
Why the 173 and 162 figures differ
The numbers refer to different snapshots of a live investigation. Huntress reported 162 confirmed unauthorized sign-ins as of 19:00 UTC on October 16, 2026. An October 17 update in the managed-service-provider community reported unauthorized sign-ins in 173 partner and customer tenants. The later figure does not contradict the earlier one; monitoring had identified additional tenants. The contemporaneous update is documented at r/MSP.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Applications and identifiers to look for
Names can differ by tenant age and deployment history. Search Enterprise applications and app registrations for the current and legacy names, then verify the application IDs rather than relying on display names alone.
| Application | Application ID | What to check |
|---|---|---|
| ConnectWise Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae |
May appear as SkyKick Backup or SkyKick Cloud Manager in older tenants. Review sign-ins, consented permissions and recent activity. |
| ConnectWise Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
In one tenant, this service principal assigned itself Global Administrator and added client secrets to other applications. |
| Huntress Security Platform | Not stated | Include it in the credential review if it is installed; investigate any secret added unexpectedly. |
Immediate containment in Entra ID
- Disable, do not delete, the service principals. In the Microsoft Entra admin center, open Enterprise applications, choose All applications, search for ConnectWise Cloud Backup, SkyKick Backup or SkyKick Cloud Manager, open the matching service principal, and set its enabled state to disabled. Repeat for ConnectWise Cloud Management – MS Teams. Keeping the objects allows you to preserve evidence while preventing new sign-ins.
- Check sign-in logs. Open Monitoring and Sign-in logs for each application. Filter for the application IDs above, the IP address
144.172.64.128, and the October 15 onward time window. Export relevant records under your normal retention and incident-handling procedures. - Review audit logs for privilege changes. In Monitoring and Audit logs, look for service-principal role assignments, application changes, consent changes and credential operations. Huntress saw directory-role assignments in roughly 50 monitored tenants, most commonly Exchange Administrator.
- Remove roles the applications were never meant to hold. Pay particular attention to Global Administrator, Privileged Authentication Administrator and Exchange Administrator assignments. Record the original assignment and the removal time for your incident record.
- Inspect every application credential. In Enterprise applications and App registrations, review client secrets and certificates, especially credentials created or modified since October 13. Remove secrets or certificates that no owner can explain. In one tenant, attackers added secrets expiring in 2028 to other applications, including a Huntress application.
- Do not assume disabling is sufficient. Disabling the abused service principals does not delete credentials already planted in other applications. Continue reviewing those applications and any tokens or activity associated with them.
- Keep the applications disabled until rotation is confirmed. ConnectWise must confirm that the compromised vendor credentials have been reset and provide an incident-closure or re-enablement process before you restore either application.
What the attacker could reach
App-only Graph tokens operate as the application, not as a human employee. The possible exposure therefore follows the permissions previously consented in each tenant. Depending on that scope, investigate mailbox content and mail rules, OneDrive and SharePoint files, Teams messages or files, directory objects, and any administrative changes made through the application. The presence of a token does not prove that every listed data type was read, but it establishes that the application had a path to whatever its permissions allowed.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Signs that require escalation
- A service principal assigned itself a directory role, particularly Global Administrator, Privileged Authentication Administrator or Exchange Administrator.
- A client secret or certificate appeared on an unrelated enterprise application or app registration after October 13, especially with an expiration date in 2028.
- Sign-ins for either listed application ID originate from
144.172.64.128or another location your normal backup activity does not use. - Mailbox, SharePoint, OneDrive or Teams access appears without a corresponding backup job or administrator action.
- The tenant cannot explain why the ConnectWise or legacy SkyKick application had the permissions it held.
What administrators should communicate internally
Tell responders and affected customers that this was a vendor application-credential compromise. Resetting user passwords or requiring new MFA challenges can protect human accounts, but those steps do not rotate the compromised app secret or remove app-only access. Preserve Entra sign-in and audit records, document every role and credential change, and coordinate any data-exposure assessment with your incident-response and legal teams.
ConnectWise Cloud Backup may be legitimate software in the tenant; its presence alone is not proof of compromise. The decisive checks are the service principal’s sign-ins, role and credential changes, source addresses, and whether activity matches an authorized backup operation.
Quick Recap
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
