Microsoft is tracking what it calls an active supply chain attack against ConnectWise Cloud Backup, the tool formerly sold as SkyKick Backup. An intruder took control of the application’s trusted OAuth identity and used it to mint access tokens inside customer tenants, signing in to 173 Microsoft 365 environments.
The sign-in burst landed on October 15, 2026, all of it originating from 144.172.64.128. From there the operator ran Microsoft Graph reconnaissance and tried to attach fresh credentials to the same service principal, a move that would have kept a direct backdoor open even after the initial tokens died.
Why one app identity was enough
The abuse worked because customers had already consented to broad permissions, including Directory.ReadWrite.All. That consent is the whole attack surface: nothing about the OAuth app was broken, it was simply trusted far enough that whoever held it could walk into every tenant that had approved it.
ConnectWise has confirmed unauthorized access to application identities inside the Cloud Backup environment. It has cut off the service’s application access while investigation and remediation continue, which also means backup operations tied to the platform are interrupted.
What defenders should check now
Microsoft’s guidance points at three artifacts: service principal sign-ins from unfamiliar IP addresses, credential changes on enterprise applications, and OAuth grants tied to AppId 506e08f9-6e9a-4da4-942b-a099a03644ae.
For managed service providers the stakes are concentrated. A single vendor app holding tenant-wide Graph rights turns one compromise into a multi-tenant event, and the affected customers may never see a malicious sign-in from their own users.
Rotate the app’s secrets, audit consent grants made on its behalf, and treat any token issued to that principal during the window as burned.
