Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

An active campaign has been identified where unknown threat actors are leveraging a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. At least 173 Microsoft 365 tenants have been affected. ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs), making the breach particularly significant due to the downstream impact on MSP customers. The attack highlights risks associated with credential compromise in MSP tooling and cloud backup services. Cybersecurity researchers are actively raising alarms about this campaign. The incident underscores the supply-chain-like risk posed when a trusted MSP vendor's credentials are compromised. No specific CVEs have been mentioned in the available content.