One Stolen Login Just Opened 173 Microsoft 365 Accounts

Emily Davis · 2026-10-17

Imagine a single key that unlocks hundreds of doors. That's basically what's happening right now with a compromised Microsoft 365 (M365) credential tied to ConnectWise Cloud Backup, formerly known as SkyKick. Security researchers are raising alarms about an active campaign where unknown threat actors are using that one credential to slip into customers' M365 environments — and they've already signed in to 173 tenants. If you work with managed service providers (MSPs) or run IT for a company, this one deserves your attention. Here's what's going on and what it means for you. ### What Is ConnectWise Cloud Backup, Exactly? ConnectWise Cloud Backup is a cloud-based backup and recovery service built specifically for managed service providers (MSPs). MSPs use it to protect their clients' data — emails, files, and everything else living in Microsoft 365. Here's the catch: because it's built for MSPs, a single account can hold the keys to many client environments at once. That's efficient. It's also a very juicy target. When one credential like that gets compromised, it doesn't just expose one company. It can expose every tenant that credential touches. And right now, that number is 173. ### How the Attack Unfolded According to the researchers tracking this, the threat actors didn't need anything fancy. They got hold of a valid credential and used it to sign in — no malware, no zero-day exploit, just a working login. That's the scary part. A lot of these breaches don't involve clever hacking. They involve a password or token that shouldn't have been out in the open. - The credential belonged to ConnectWise Cloud Backup (SkyKick) - Attackers used it to authenticate into customer M365 environments - At least 173 Microsoft 365 tenants were accessed - The actors behind the campaign are still unidentified > "The most dangerous breach is often the one that looks like a normal login." That's the lesson here — and it's one every MSP should tape to their monitor. ### Why This Matters More Than It Seems You might be thinking, "Okay, one service got hit. So what?" Here's the thing — MSPs sit at the center of a huge web of client businesses. When a tool built for MSPs gets compromised, the blast radius is enormous. A small dental office in Ohio and a logistics firm in Texas could both be exposed through the same credential. Neither of them did anything wrong. They just trusted the pipeline. This is also a reminder that supply chain risk isn't just about software updates. It's about access. Credentials are the new perimeter. ### What You Should Do Right Now If you're an MSP or you rely on one, don't wait for the full report to drop. Take a few practical steps today. - Rotate any credentials tied to cloud backup services, especially ones with broad tenant access - Review sign-in logs for unusual locations, devices, or times - Enforce multi-factor authentication (MFA) everywhere — no exceptions - Limit service accounts to only the permissions they truly need - Ask your MSP how they're monitoring for this specific campaign ### The Bigger Picture on Credential Abuse This isn't an isolated story. Credential-based attacks keep climbing because they work. They're quiet, they blend in, and they don't trip the alarms that malware does. For anyone working in antidetect browsers, privacy tooling, or digital identity management, this is a familiar pattern. Access is everything. Protect the access, and you protect the business. Lose it, and 173 doors swing open at once. The researchers are still digging into how the credential was originally exposed. But one thing is already clear: if your security strategy stops at the login screen, you're leaving the back door wide open.