[microsoft-threat-intelligence]

October 18, 2026

• ConnectWise Cloud Backup (formerly SkyKick) is the pivot in an active Microsoft 365 supply-chain compromise. Microsoft Threat Intelligence says the actor abused the multitenant app's existing consent — including Directory.ReadWrite.All — to obtain access tokens, observing broad successful service-principal authentication from 144.172.64[.]128 on October 15, followed by Microsoft Graph reconnaissance and attempts to add new credentials to the service principal as a backdoor, which survives revocation of the original compromised credential (Microsoft Threat Intelligence). The app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae; observed user agents are Python-urllib/3.12 and python-requests/2.31/2.34.2. Huntress, which raised the alarm on October 16, says the actor signed into 173 tenants, up from its initial 162 (Huntress, BleepingComputer, The Hacker News). · Cloud & Identity

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants