Nice2GeekYou

Stolen Backup-App Key Opened Microsoft 365 Tenants — Check Your Connected Apps Today

Attackers used a stolen credential for ConnectWise Cloud Backup (formerly SkyKick) to sign in to Microsoft 365 tenants as the app itself. MFA didn't apply. Here's the 15-minute check for any business on Microsoft 365.

  • microsoft-365
  • supply-chain
  • entra-id
  • cloud-backup
  • connectwise
  • skykick
  • cybersecurity
  • msp
  • smb
  • managed-it

Attackers stole a credential belonging to ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants as the backup app itself, BleepingComputer reported on October 17. Huntress confirmed unauthorized sign-ins in at least 162 tenants, Microsoft called it an active supply-chain attack, and ConnectWise shut off the service while it investigates. As of October 18, scheduled backups were not running and restores were unavailable.

Why MFA didn't stop it

A backup app needs broad access to copy and restore email, OneDrive, SharePoint and Teams. When an attacker signs in as the app, there's no user and no MFA prompt, so they inherit whatever permissions the app was granted. In one tenant Huntress watched, a related ConnectWise app gave itself Global Administrator and planted new secret keys on two other apps in about five minutes. Those planted keys keep working even after the vendor's credential is reset.

The 15-minute check (any Microsoft 365 business)

  1. Find your connected apps. In the Microsoft Entra admin center, open Enterprise applications and search for "SkyKick" and "ConnectWise." Older tenants may show "SkyKick Cloud Manager."
  2. Disable, don't delete. If you find one, set "Enabled for users to sign-in" to No. Deleting removes consent and complicates restores. Disabling pauses backups but email and files keep working.
  3. Look for new keys. Review client secrets and certificates on every app registration, especially security and management tools, for anything added since October 13 that you didn't create. Remove it.
  4. Check admin roles. If any third-party app holds Global Administrator or Exchange Administrator and you didn't grant it on purpose, remove the role.
  5. Plan for the backup gap. If you rely on this service, set up a temporary second backup until the vendor confirms all credentials are reset.

Even if you've never used SkyKick, this is a good week to ask: which outside apps have admin-level access to our Microsoft 365, and do we still need them? Old, forgotten integrations are exactly what attackers look for.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans help remote clients across the U.S. audit Microsoft 365 app permissions, lock down admin roles and keep independent backups. Request a quote or see our monthly plans.

Sources: BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack; Huntress — ConnectWise (SkyKick) vendor credentials abused in M365 attacks.