A trusted backup app's OAuth credential became the key to hundreds of customer tenants.
The Hacker News reports that attackers used a compromised credential belonging to ConnectWise's Cloud Backup application, formerly SkyKick, to sign into at least 173 partner and customer Microsoft 365 tenants. Huntress and Microsoft say the sign-ins came from a single IP address and began on October 15, exploiting the app's existing broad permissions to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats. Because the activity ran through an automated script rather than a user login, multi-factor authentication did not stop it.
In at least one partner tenant, Huntress found that a separate ConnectWise application escalated itself to Global Administrator and added credentials to other trusted apps to maintain access. ConnectWise has shut off Cloud Backup application access while it investigates and says it has found no evidence that backup data itself was compromised, but the full victim count and how the vendor credential was obtained remain unclear.
Why it matters: a trusted third-party SaaS integration carries the same blast radius as a direct breach once it holds broad OAuth permissions. Enterprises should inventory connected apps, audit what scopes they actually need, and watch for privilege escalation inside vendor-granted tokens, not just user accounts.