Attackers Abuse ConnectWise Cloud Backup Identity to Request Microsoft 365 Access Tokens Across Customer Tenants

On 15 October 2026, Sophos X-Ops researchers identified automated sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The activity came from a single virtual private server and ran for about 96 minutes, from 07:11 to 08:47 UTC. Researchers found no sign of hands-on-keyboard activity and assess with high confidence that a script worked through a list of tenants that had consented to the application.

The sign-ins needed no user password and no multi-factor authentication, because the attacker used the application's own identity. Sophos says this is consistent with abuse of a compromised credential held by the vendor. It is not yet clear how the credential was obtained, or what the attacker did with the tokens. When customers enable the backup product, they consent to the application in their tenant, so anyone holding its credential can request the same kind of token in every consenting tenant.

ConnectWise published an advisory, along with a technical investigation and remediation guide, and shut off Cloud Backup application access for partners and customers as a protective measure. As of publication, Sophos had seen no evidence that the application created new secrets, applications, consents, or role assignments in the tenants reviewed. This summary is based on the opening of the Sophos article, so it does not cover the full report.