Hackers exploited a compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 tenants, leveraging the app’s broad permissions to access mailboxes, files, and directory data. The attackers used the credential to obtain Microsoft Graph tokens and added themselves to privileged roles in some environments, escalating their access. ConnectWise has disabled the Cloud Backup application’s access while investigating and recommends tenants disable the app until the credentials are reset.
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html