Date: October 17, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Cloud Security / Supply Chain Attacks / Microsoft 365 / Identity and Access Management / MSP Security
Tags: ConnectWise, SkyKick, Microsoft 365, Huntress, Multi-Tenant Security, Entra ID, OAuth, Client Secrets, MSP Security, Supply Chain
Executive Summary
The enterprise cloud ecosystem faced a severe supply chain crisis on October 16–17, 2026, as cybersecurity threat detection firm Huntress Labs disclosed active, confirmed unauthorized intrusions across at least 173 Microsoft 365 customer tenants. The incident stemmed not from compromised user passwords or stolen session cookies, but from the compromise of a central multi-tenant application credential belonging to ConnectWise Cloud Backup (formerly SkyKick).
As detailed by Huntress Labs and reported by The Hacker News, ConnectWise Cloud Backup is a widely deployed cloud-to-cloud backup utility used by Managed Service Providers (MSPs) to safeguard enterprise Microsoft 365 environments. To perform automated backups, the application requires extensive, tenant-wide administrative permissions—including full access to user mailboxes (Mail.ReadWrite), SharePoint and OneDrive repositories (Files.ReadWrite.All), and directory data (Directory.Read.All).
When the vendor’s multi-tenant client secret fell into hostile hands, threat actors gained an unconstrained master key. By supplying target Microsoft 365 Tenant IDs, the adversaries authenticated directly to Microsoft’s identity endpoints, querying confidential emails, customer files, and organizational structures across hundreds of enterprises without needing user credentials or triggering Multi-Factor Authentication (MFA).
Technical Deep-Dive: Deconstructing the Multi-Tenant OAuth Compromise
To understand how a single leaked vendor credential compromised hundreds of independent corporate environments, we dissect the architecture of Microsoft Entra ID multi-tenant applications, application-only permissions, and the mechanics of the intrusion.
Stage
Step & Protocol
Source / Endpoint
Action & Data Flow
Threat Vector / Impact
1
Target Reconnaissance
OpenID Discovery Endpoint
Query https://login.microsoftonline.com/
Discovers target Microsoft 365 Tenant GUIDs using publicly known organizational domain names.
2
Authentication
OAuth 2.0 Token Endpoint
POST /
Authenticates directly via non-interactive Client Credentials Grant flow. Bypasses user password policies and MFA prompts completely.
3
Consent & Validation
Microsoft Entra ID
Validates client_secret against target tenant Service Principal registration
Confirms target tenant holds pre-existing Admin Consent for ConnectWise application. Token is generated without triggering Conditional Access.
4
Token Issuance
Microsoft Identity Platform
Issues Microsoft Graph API Bearer Token
Token contains high-privilege application scopes: Mail.ReadWrite, Files.ReadWrite.All, Directory.Read.All.
5
Unauthorized Access
Microsoft Graph API
Executes automated requests:• GET /v1.0/users/
Direct exfiltration of executive mailboxes, financial disclosures, legal contracts, and complete employee directories.
6
Impact
Corporate Tenant Data
Mass Data Exfiltration
Full enterprise visibility achieved without creating user sign-in logs or triggering user-focused SOC alerts.
1. The Multi-Tenant Architecture: Application Permissions vs. Delegated Permissions
In the modern Microsoft cloud architecture, software-as-a-service (SaaS) integrations authenticate via Microsoft Entra ID (formerly Azure Active Directory):
* The Consent Model: When an MSP or enterprise installs a third-party tool, a Global Administrator executes an "Admin Consent" flow. This creates a local Service Principal in the customer’s tenant that links to the vendor's central multi-tenant application registration.
* Application-Only Permissions: Unlike delegated permissions (which act on behalf of a signed-in user and enforce the user's specific access rights), backup utilities require Application Permissions. Application permissions operate as an autonomous service identity possessing organization-wide authority.
* The High-Privilege Scopes: ConnectWise Cloud Backup held extraordinary entitlements:
* Mail.ReadWrite: Complete read and write access to all mailboxes in the organization.
* Files.ReadWrite.All: Unrestricted access to all files stored in SharePoint Online and OneDrive for Business.
* Directory.Read.All: Unrestricted access to user profiles, groups, and directory metadata.
2. The Exploitation Mechanism: Zero MFA, Zero Passwords
The vulnerability did not exploit a software coding bug, but rather the catastrophic compromise of a shared cryptographic key:
* The Client Credentials Grant: Under the OAuth 2.0 specification, non-interactive service identities authenticate using the client_credentials grant flow. The application sends an HTTP POST request containing its client_id and client_secret directly to the token endpoint of the target tenant.
* Finding the Targets: An attacker with the vendor's client secret only needed to identify which organizations had installed the application. Tenant IDs are trivial to discover: querying https://login.microsoftonline.com/
* Bypassing Identity Defenses: Because this authentication occurs entirely between backend services:
* User password policies and Multi-Factor Authentication (MFA) prompts were never evaluated.
* Standard user Conditional Access policies (e.g., requiring compliant devices or trusted IP ranges) did not apply.
* Standard user sign-in logs showed zero activity, hiding the intrusion from basic SOC monitoring.
3. Forensic Findings & Scope of Compromise
Huntress Labs’ threat detection telemetry tracked active threat actor operations:
* Confirmed Infiltration in 173 Tenants: Huntress observed confirmed unauthorized sign-in events using the compromised vendor credential across 173 customer and partner environments.
* Automated Intelligence Harvesting: The actors executed automated scripts to pull employee directory listings, identify executive and IT leadership mailboxes, and scrape SharePoint document libraries containing intellectual property, legal contracts, and financial disclosures.
* Emergency Remediation: ConnectWise, Microsoft, and Huntress coordinated to invalidate the compromised client secret and disable the application registration globally, severing the attacker’s access.
Industry Impact & The MSP Supply Chain Dilemma
This incident illustrates the acute systemic risk of modern SaaS integrations:
* The Asymmetric Threat of Multi-Tenant Apps: A single credential leak at a SaaS provider provides adversaries with an automated backdoor into thousands of independent corporate enterprises simultaneously.
* The Blind Spot of Service Principal Monitoring: Enterprise security teams invest heavily in monitoring user logins, phishing, and session hijacking, while automated Service Principals and Workload Identities often operate with near-total administrative access without active behavioral monitoring.
Defensive Hardening Blueprint & Remediation Strategies
To remediate the ConnectWise incident and protect Microsoft 365 environments from multi-tenant supply chain risks, security administrators must execute the following controls:
1. Immediate Actions for ConnectWise Cloud Backup Customers
* Verify Application Status: In the Microsoft Entra admin center, navigate to Identity -> Applications -> Enterprise applications.
* Locate the ConnectWise Cloud Backup (or legacy SkyKick) application.
* If the application is still active, navigate to Properties and set "Enabled for users to sign-in?" to No, or delete the Enterprise Application entirely until ConnectWise confirms new, rotated credentials.
* Audit Sign-In Logs: Navigate to Monitoring -> Sign-in logs and select the Service principal sign-ins tab. Filter by the ConnectWise Application ID and inspect all sign-in events occurring between October 10 and October 17, 2026, for anomalous IP addresses.
2. Deploy Conditional Access for Workload Identities
Never allow service principals to authenticate from arbitrary internet IP addresses:
* Configure Microsoft Entra Conditional Access for Workload Identities.
* Restrict service principal authentication strictly to trusted, static IP ranges owned by the SaaS vendor, instantly blocking threat actors operating from unauthorized VPS or proxy networks.
3. Enforce Continuous OAuth Consent Governance
* Conduct Quarterly App Reviews: Review all third-party enterprise applications consented across your Microsoft 365 tenant. Immediately revoke consent for abandoned or unneeded integrations.
* Enforce Admin Consent Workflows: Prohibit standard users from consenting to third-party applications. Mandate multi-party administrative review before granting high-risk application permissions (Mail.ReadWrite, Files.ReadWrite.All).
4. Transition to Certificate-Based Authentication & Workload Federation
* Enterprise architects should demand that cloud SaaS vendors migrate away from shared static client_secret passwords.
* Mandate the use of X.509 Mutual TLS Certificates stored in hardware security modules (HSMs) or Workload Identity Federation (OIDC), eliminating static credentials that can be leaked or stolen.
For cloud supply chain threat intelligence, Microsoft 365 security teardowns, and identity defense blueprints, subscribe to Digital Spying.