ConnectWise Cloud Backup Credential Abuse: 173 M365 Tenants Compromised in Trust-Through-Defaults Incident

Threat actors weaponized a vendor-managed credential in ConnectWise Cloud Backup to authenticate across 173 Microsoft 365 tenants on October 15, 2026. The credential lived in ConnectWise’s own tenant. Customer-side defenses – multi-factor authentication, conditional access, session controls – could not touch it. This is the tenth trust-through-defaults incident on this desk since September 26. The pattern now reaches the managed service provider layer. Huntress documented the incident in a report published October 16. The compromised credential was a client assertion – a type of API secret that proves an application’s identity to Microsoft Entra without involving a user. Because ConnectWise Cloud Backup is granted broad permissions to do its job (Exchange Online mailboxes, OneDrive, SharePoint, Teams chats, and directory data), an attacker holding tokens for that application inherits the same…

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.