ConnectWise Cloud Backup Credential Abuse: 173 M365 Tenants Compromised in Trust-Through-Defaults Incident
Photo: Forkast
Threat actors weaponized a vendor-managed credential in ConnectWise Cloud Backup to authenticate across 173 Microsoft 365 tenants on October 15, 2026. The credential lived in ConnectWise’s own tenant. Customer-side defenses – multi-factor authentication, conditional access, session controls – could not touch it. This is the tenth trust-through-defaults incident on this desk since September 26. The pattern now reaches the managed service provider layer. Huntress documented the incident in a report published October 16. The compromised credential was a client assertion – a type of API secret that proves an application’s identity to Microsoft Entra without involving a user.
Source: Forkast
