Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A compromised application credential belonging to ConnectWise Cloud Backup, formerly SkyKick Backup, was used to obtain Microsoft Graph tokens in customer Microsoft 365 tenants. Huntress had confirmed 162 unauthorized sign-ins by 19:00 UTC on October 16, 2026; an October 17 MSP update reported 173 affected partner or customer tenants. The count was still changing, and the incident involves an application identity rather than ordinary user-password theft.
Administrators should disable the affected service principals, search Entra sign-in and audit logs, remove unauthorized roles and application credentials, and keep the apps disabled until ConnectWise confirms vendor credential rotation. Huntress’s incident advisory is at https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access.
What the 173-tenant incident means
The incident began when an API secret for the ConnectWise Cloud Backup application was compromised. Because that secret belonged to the vendor’s Microsoft Entra tenant, customers did not create the resulting authentication events themselves. The attackers used the application’s existing delegated consent and application permissions to request Microsoft Graph access tokens in customer tenants.
Recommended Free Tools
Those permissions can reach the Microsoft 365 resources that a backup integration was authorized to use, potentially including Exchange Online mailboxes, OneDrive, SharePoint, Teams and directory data. A sign-in confirms unauthorized access to the tenant; it does not by itself prove that every accessible file or message was copied.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
| Report | Time and date | Figure | What it represents |
|---|---|---|---|
| Huntress investigation | 19:00 UTC, October 16, 2026 | 162 | Confirmed unauthorized sign-in tenants |
| MSP community update | October 17, 2026 | 173 | Unauthorized sign-ins reported across partner or customer tenants |
The two numbers are not contradictory: monitoring continued between the reports. The October 17 figure comes from a contemporaneous update at https://www.reddit.com/r/msp/comments/1x7wbwf/connectwise_skykick_update/.
How the attackers used the application identity
Microsoft Graph tokens, not a user MFA bypass
The exposed secret authenticated the ConnectWise Cloud Backup service principal. Microsoft Entra then issued Microsoft Graph tokens with the permissions already consented by each customer tenant. Since this is app-only authentication, changing a user’s password or requiring MFA for users does not invalidate the vendor application credential.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Older environments may show the same integration as SkyKick Backup or SkyKick Cloud Manager. The Cloud Backup application ID identified in the advisory is 506e08f9-6e9a-4da4-942b-a099a03644ae.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Privilege escalation in monitored tenants
In roughly 50 monitored tenants, ConnectWise Cloud Management service principals assigned themselves directory roles, most often Exchange Administrator. In one tenant, the ConnectWise Cloud Management – MS Teams application (ID 24205314-2b89-4e07-a2a4-579e898a5640) assigned itself Global Administrator and added client secrets to other applications, including a Huntress application. Those newly added secrets were configured to expire in 2028, which could have prolonged access after the original application was disabled.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Check whether your tenant contains the affected apps
Search enterprise applications
- Open the Microsoft Entra admin center and go to Enterprise applications > All applications.
- Search for ConnectWise Cloud Backup, SkyKick Backup and SkyKick Cloud Manager. Also search for ConnectWise Cloud Management and its Teams application.
- Open each matching service principal and record its application ID, owners, permissions, role assignments and sign-in status before making changes.
| Identity to look for | Application ID or naming clue | Why it matters |
|---|---|---|
| ConnectWise Cloud Backup | 506e08f9-6e9a-4da4-942b-a099a03644ae |
Vendor credential was compromised and used to obtain Graph tokens |
| SkyKick Backup / SkyKick Cloud Manager | Legacy display names for the same backup integration | Older tenants may not show the ConnectWise name |
| ConnectWise Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
Observed assigning itself Global Administrator in one tenant |
Search sign-in and audit records
- In Entra, open Monitoring & health > Sign-in logs and filter by the application IDs above.
- Look for authentication from
144.172.64.128, the hosting-provider address observed on October 15. - Review the same period for service-principal sign-ins, unusual countries or times, and access to tenants where the integration was not expected to run.
- Open Audit logs and inspect directory-role assignments, application-registration changes, and service-principal credential additions beginning October 13. Record the actor, target application, timestamp and resulting credential or role.
Keep exported log records with your incident timeline. A missing event in one log view does not establish that no access occurred; retention and licensing controls differ between tenants.
Contain the compromise now
1. Disable both service principals
In each affected enterprise application, open Properties, set Enabled for users to sign-in to No, and save. Disable both the ConnectWise Cloud Backup or legacy SkyKick service principal and the ConnectWise Cloud Management – MS Teams service principal. Disabling is safer than deleting during investigation because it preserves identifiers and audit context.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
2. Remove unauthorized directory roles
Review role assignments for each service principal and remove any assignment that was not intentionally approved for the backup design. Prioritize Global Administrator, Privileged Authentication Administrator and Exchange Administrator. Capture the original assignment and removal time for your incident records.
3. Remove credentials added to applications
Disabling an abused app does not remove client secrets or certificates that an attacker already added elsewhere. Inspect App registrations and Enterprise applications across the tenant, paying particular attention to credentials created from October 13 onward. Delete secrets and certificates that no owner can validate, including credentials added to the Huntress Security Platform application if it is installed. Reissue legitimate credentials only through your normal change process.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
4. Assess the data and identity exposure
- Identify mailboxes, SharePoint sites, OneDrive accounts, Teams data and directory objects covered by the application’s granted permissions.
- Check for mailbox-rule changes, suspicious forwarding, new application consent, new service principals and additional role assignments.
- Preserve relevant sign-in, audit and application-credential evidence before retention limits remove it.
- Notify affected users and your incident-response provider according to your breach-notification obligations if investigation confirms data access.
Why disabling the app is not the final fix
The original secret may have been used to create other credentials or elevate other applications. Therefore, turning off the two named service principals blocks their future sign-ins but does not invalidate secrets already planted in another app registration. Credential inventory and role review are separate containment tasks.
Huntress states that “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added.” Its advisory also identifies the compromise as a ConnectWise Cloud Backup API secret being used for unauthorized access: https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access.
When it is safe to re-enable the integration
Leave the service principals disabled until ConnectWise confirms that all vendor-side credentials involved in the incident have been reset. Before re-enabling, require a written scope and remediation statement, verify that the tenant’s role assignments and app credentials match your approved configuration, and test that the backup application has only the permissions needed for its documented workload.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAfter restoration, monitor service-principal sign-ins and audit events closely. A safer long-term configuration minimizes Graph permissions, restricts administrative consent, alerts on new application secrets and directory-role assignments, and regularly tests whether backups can be restored without granting unnecessary access.
Quick Recap
What administrators should remember
- This was an application-credential compromise, so user MFA alone does not remediate it.
- The affected integration may be labeled ConnectWise Cloud Backup, SkyKick Backup or SkyKick Cloud Manager.
- Reported tenant counts changed from 162 confirmed by Huntress on October 16 to 173 in an October 17 MSP update.
- Containment requires disabling service principals, reviewing logs, removing unauthorized roles and credentials, and waiting for vendor credential rotation.
- App-only tokens could reach the mailbox, file, Teams and directory data covered by the application’s existing permissions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
