One Stolen Login Just Opened 173 Microsoft 365 Accounts

Emily Davis · 2026-10-17

Picture this: a single set of login credentials, sitting quietly on a server somewhere, suddenly becomes the master key to 173 different companies' Microsoft 365 environments. That's not a hypothetical. That's happening right now. Cybersecurity researchers have raised the alarm about an active campaign where unknown threat actors are abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup, formerly known as SkyKick. The goal? Sliding into customers' M365 environments without anyone noticing. ### What ConnectWise Cloud Backup Actually Does If you're not deep in the managed service provider world, here's the short version. ConnectWise Cloud Backup is a cloud-based backup and recovery service built specifically for MSPs. These are the folks who handle IT for dozens or even hundreds of small businesses at once. That's the part that makes this scary. When an MSP's tooling gets compromised, the blast radius isn't one company. It's every client that MSP touches. ### Why One Credential Can Do So Much Damage Think of it like a building superintendent who holds keys to every apartment on the block. Lose that keyring, and suddenly every door is open. A backup service credential often carries broad permissions because it needs to reach into many tenants to do its job. According to the researchers tracking this campaign, the attackers used that single compromised credential to sign in to 173 Microsoft 365 tenants. Not 17. Not 73. One hundred and seventy-three. - A single point of failure turned into a wide-reaching breach vector - Backup and recovery tools often hold elevated access by design - MSPs sit at the center of a hub-and-spoke model, so their tools are high-value targets ### The Bigger Lesson for Anyone Using Antidetect Browsers Here's where it gets personal for people in our space. Many of you run antidetect browsers to manage multiple accounts, test campaigns, or protect your identity across platforms. That's legitimate work. But this story is a reminder that credential hygiene is everything. > "The weakest link in any security stack isn't the software. It's the login that never got rotated." If a service you rely on gets compromised, your careful browser fingerprinting won't save you. The account itself is already gone. So what should you actually do? - Rotate credentials regularly, especially for tools with broad access - Turn on multi-factor authentication everywhere it's offered - Audit which third-party services can reach your accounts and cut the ones you don't use - Watch for unusual sign-in activity across all your tenants, not just the main one ### What This Means Going Forward Researchers are still piecing together the full scope of this campaign. What's clear is that supply chain style attacks against MSP tooling are not slowing down. The best antidetect browser in the world protects your fingerprint. It doesn't protect a stolen password. So treat your credentials like the keys they are. Because 173 companies just learned that lesson the hard way.