One Stolen Password Just Opened 173 Microsoft 365 Accounts

Michael Miller · 2026-10-17

Cybersecurity researchers are raising the alarm about an active campaign. Unknown threat actors are using a compromised Microsoft 365 (M365) credential tied to ConnectWise Cloud Backup to break into customers' M365 environments. If you work with managed service providers, this one deserves your attention. ConnectWise Cloud Backup, formerly known as SkyKick, is a cloud-based backup and recovery service built for managed service providers (MSPs). MSPs manage IT for many client businesses at once, which is exactly why this attack matters. One trusted credential can sit in front of hundreds of downstream accounts. ### Why one credential can reach so many tenants Think of an MSP as a building superintendent who holds keys to every unit. If someone copies that master key, they don't need to pick a single lock. They just walk in. That's the shape of this campaign. A single credential tied to a backup service became the master key, and the attackers used it to sign in to 173 Microsoft 365 tenants. The number alone tells you the blast radius isn't small. Here's what makes it worse: backup tools often hold broad permissions by design. They need to read and restore data across mailboxes, files, and settings. That convenience becomes a liability when the credential leaks. ### What the attackers were after Once inside, the usual playbook kicks in. Threat actors in these M365 intrusions typically aim to: - Read and exfiltrate email and files - Set up persistence so access survives a password reset - Pivot into other connected tenants - Harvest data for fraud, ransomware, or resale The details of this specific campaign are still developing, but the pattern is familiar. Attackers rarely stop at the first door they open. ### The uncomfortable lesson for MSPs If you run an MSP or rely on one, this is a gut-check moment. Most breaches don't start with genius-level hacking. They start with a credential that was reused, phished, or left unrotated for too long. > "A single stolen password should never be enough to reach a hundred customers. If it is, the problem isn't the password. It's the architecture." That quote sums up the real issue. Trust boundaries matter. Least privilege matters. And monitoring matters most of all, because a quiet sign-in from an unusual location is often the only warning you get. ### Practical steps to protect your tenants You don't need a massive budget to reduce risk here. You need discipline. Start with these moves: - Rotate credentials for every third-party integration on a set schedule - Enforce multi-factor authentication everywhere, especially on service accounts - Limit backup tool permissions to only what's needed - Review sign-in logs for unusual locations or impossible travel - Set alerts for bulk mailbox access or mass file downloads ### Where antidetect browsers fit in For security teams and MSPs testing their own defenses, antidetect browsers help simulate how attackers mask their footprints. They let you study suspicious sign-in patterns and harden detection rules before a real intruder tests them for you. For legitimate multi-account professionals, the same tooling keeps accounts separated and clean. The goal is control, not chaos. ### The bottom line One compromised credential reaching 173 tenants is a wake-up call, not a fluke. Attackers are counting on sloppy credential hygiene and over-permissioned tools. Tighten both, and you take away the master key they're hoping to find. Check your integrations today. It's a lot easier than explaining a breach tomorrow.