Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Threat actors have compromised a Microsoft 365 credential used by ConnectWise Cloud Backup, enabling unauthorized access to 173 Microsoft 365 tenant environments. The attackers used the stolen credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128, moving systematically through tenants in sorted GUID order, indicating automated tooling. In at least one tenant, a malicious actor assigned the ConnectWise Cloud Management app Global Administrator privileges and added new client secrets to privileged applications, including an MSP management tool and the Huntress Security Platform, expanding access across customer environments. Organizations with the ConnectWise app installed remain at risk until credentials are rotated and the app is disabled.

AI-extracted · verify before operational use