Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Hackers use a stolen ConnectWise credential to access 173 Microsoft 365 tenants.
Run ConnectWise?
Get an email when a reviewed story names ConnectWise, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Unknown threat actors are actively exploiting a compromised Microsoft 365 credential associated with ConnectWise Cloud Backup. This credential has been used to gain unauthorized access to 173 customer Microsoft 365 environments, highlighting a significant supply chain risk for managed service providers and their clients.
The lesson from this incident
Full lessonA single compromised credential tied to ConnectWise Cloud Backup was leveraged by threat actors to access 173 separate Microsoft 365 customer environments, illustrating the cascading danger of supply chain credential compromise. Managed service providers (MSPs) and their tooling represent a high-value, high-trust target because a single breach can propagate instantly across hundreds of downstream clients. The incident underscores how privileged third-party service accounts often lack the same scrutiny as internal credentials, creating a blind spot in access governance. Without robust monitoring and multi-factor authentication on service accounts, attackers can move laterally across tenant boundaries largely undetected.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
- malware — ConnectWise Cloud Backup