Brief · Both
The backup app had the keys to every tenant
ConnectWise Cloud Backup (formerly SkyKick) runs as a multitenant Microsoft 365 app. Someone got hold of its app credential. Per ConnectWise, "Our investigation identified compromised application identities," and it fixed things by "revoking certificates used for affected application connections." So the credential was most likely a certificate. How it got out, ConnectWise says, "remains under investigation."
Between 2:13 and 4:34 AM ET on Oct 15, Huntress says, the backup app signed in to tenant after tenant from 144.172.64[.]128. Inforcer and Todyl saw the same sweep in the tenants they monitor, starting at 2:53 and 3:11 AM ET and ending by 4:47 AM ET. Huntress says that "As of 19:00 UTC on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants." By 5:15 PM ET Oct 17, Huntress said almost 1,000 Entra tenants had sign-in activity from that IP and "Over 300 of those succeeded." Those are sign-ins in tenants Huntress can see, not tenants with data taken. Nobody can confirm either way, and Huntress notes that "Directory reads through Microsoft Graph leave no audit trail." Huntress also reports that in one partner tenant, a second ConnectWise app gave itself Global Administrator and planted secrets on two other apps. Huntress has not tied that to the same operator.
ConnectWise says it disabled seven app identities at 3 AM ET on Oct 17, though it first said so in an update that evening. As late as 10:30 AM that day, Huntress wrote that three of the Cloud Management apps (Exchange Online, MS Teams, SharePoint Online) didn't look disabled. By 5:15 PM, Huntress said ConnectWise "has communicated" that it had disabled them. Microsoft's only public word is a Microsoft Threat Intelligence post on X. As of Oct 18 morning, there's no CISA notice.
No AI was involved, as far as I know. Maybe AI helped someone find the weakness, but that's not the important bit anyway. The shape is familiar. An app quietly holds broad, standing access ("highly elevated permissions like Directory.ReadWrite.All," per Microsoft) in every tenant that consented. Inforcer found the app installed in about 3,800 of its managed tenants, and "roughly two in three weren't actively using it."
My take: this could happen to you if your AI agent was granted tenant-wide app permissions. Microsoft's own Entra guidance on AI agents warns agents "are often provisioned with broad permissions," and OWASP LLM06 says to limit permissions "to the minimum necessary." The attack vector is different. The blast radius is the same.
What to do:
- M365 admins:
- In Entra, find all seven ConnectWise app IDs by Application ID and set "Enabled for users to sign-in?" to No. Disable them, don't delete them; deleting removes the consent.
- Export your sign-in and audit logs now, but don't hold up disabling for it. Retention can be as short as seven days.
- Check service principal sign-ins for 144.172.64.128 from Oct 13 on, as ConnectWise advises. Huntress's core window is Oct 14, 9 PM ET to Oct 15, 10 PM ET.
- Check the audit logs for "Add member to role," "Add service principal credentials," and new secrets on any app, especially your MSP and security tools.
- Full steps are in the ConnectWise advisory and Huntress's write-up.
- Everyone with vendor apps or agents: list every app holding application permissions in your tenant. Remove the ones nobody uses. Prefer delegated, user-scoped access for agents. Watch for credential additions.
Sources
- ConnectWise Trust Center advisory
- Huntress: Vendor credential enables unauthorized access
- Todyl investigation
- Inforcer: When the backup app becomes the way in
- Beazley Security Labs: ConnectWise Cloud Backup for Microsoft 365 used to access customer tenants (BSL-A1232, Oct 16, 2026)
- Microsoft Threat Intelligence on X (Oct 17, 2026)
- Microsoft Learn: Disable user sign-in for an application
- Microsoft Entra security for AI overview
- OWASP LLM06:2025 Excessive Agency