--- title: ConnectWise (SkyKick) Vendor Credentials Abused in M365... description: ConnectWise Cloud Backup (formerly SkyKick) vendor credentials have been abused to access Microsoft 365 tenants, with unauthorized sign-ins confirmed in 162... canonical: https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks | daily.dev og:description: ConnectWise Cloud Backup (formerly SkyKick) vendor credentials have been abused to access Microsoft 365 tenants, with unauthorized sign-ins confirmed in 162... og:url: https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow og:image: https://api.daily.dev/og/posts/TQ39pGeow.png og:image:alt: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 14 min read · 0 upvotes · 0 comments ## Summary ConnectWise Cloud Backup (formerly SkyKick) vendor credentials have been abused to access Microsoft 365 tenants, with unauthorized sign-ins confirmed in 162 tenants as of October 16. The attack involved a client assertion credential from the vendor's own tenant authenticating from a hosting provider IP rather than expected Azure address space. In at least one tenant, a ConnectWise Cloud Management app assigned itself Global Administrator and added new client secrets to an MSP management tool and Huntress's own security application, persistence techniques mapping to MITRE ATT&CK T1098.001 and T1078.004. Huntress recommends immediately disabling the affected ConnectWise/SkyKick applications (without deleting them), reviewing Entra audit logs and credentials added since October 13, and not re-enabling until ConnectWise confirms credential resets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What application ID should I disable in Microsoft Entra if I use ConnectWise Cloud Backup (SkyKick)? Disable the application with ID 506e08f9-6e9a-4da4-942b-a099a03644ae, listed as ConnectWise Cloud Backup (formerly SkyKick Backup), in Enterprise applications by setting 'Enabled for users to sign-in' to No. Do not delete it, since deletion removes consent and requires re-consent to restore service. Also check related ConnectWise Cloud Management app IDs for Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. _Teams racing to lock down Microsoft 365 tenants follow incident guidance like this on daily.dev._ ### How did attackers get unauthorized access to Microsoft 365 tenants through ConnectWise SkyKick? Attackers obtained the ConnectWise Cloud Backup application's client assertion credential, which lives in the vendor's own tenant, and used it to sign in to customer Microsoft 365 tenants from the IP 144.172.64.128 instead of normal Azure private IP space. This granted Microsoft Graph access tokens with the app's existing broad permissions over mailboxes, OneDrive, SharePoint, Teams, and directory data, without any action needed from the customer. _Security teams tracking vendor credential compromises follow breakdowns like this on daily.dev._ ### What persistence technique did attackers use after compromising the ConnectWise Cloud Management Teams app? In one tenant, the ConnectWise Cloud Management app for Microsoft Teams (app ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then used a Python script to add new client secrets to an MSP management application and to Huntress's own security platform application, with the new secrets set to expire in 2028. This maps to MITRE ATT&CK technique T1098.001, Account Manipulation: Additional Cloud Credentials. _Admins investigating cloud credential persistence techniques reference incident writeups like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack](https://daily.dev/posts/microsoft-links-storm-0940-to-connectwise-supply-chain-attack-udattnmm4) · Dark Reading · 1 upvotes · 0 comments - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments - [Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps](https://daily.dev/posts/principal-problems-app-registrations-service-principals-and-the-hidden-risk-of-multi-tenant-apps-b8y0waaih) · SpecterOps · 0 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#cyber](https://daily.dev/tags/cyber), [#microsoft](https://daily.dev/tags/microsoft), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","url":"https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow"},"datePublished":"2026-10-17T07:38:20.410Z","dateModified":"2026-10-19T22:04:18.284Z","description":"ConnectWise Cloud Backup (formerly SkyKick) vendor credentials have been abused to access Microsoft 365 tenants, with unauthorized sign-ins confirmed in 162...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8b77263100f375814c244d29a4c904af?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8b77263100f375814c244d29a4c904af?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,cyber,microsoft,oauth","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-tq39pgeow#faq","mainEntity":[{"@type":"Question","name":"What application ID should I disable in Microsoft Entra if I use ConnectWise Cloud Backup (SkyKick)?","acceptedAnswer":{"@type":"Answer","text":"Disable the application with ID 506e08f9-6e9a-4da4-942b-a099a03644ae, listed as ConnectWise Cloud Backup (formerly SkyKick Backup), in Enterprise applications by setting 'Enabled for users to sign-in' to No. Do not delete it, since deletion removes consent and requires re-consent to restore service. Also check related ConnectWise Cloud Management app IDs for Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. Teams racing to lock down Microsoft 365 tenants follow incident guidance like this on daily.dev."}},{"@type":"Question","name":"How did attackers get unauthorized access to Microsoft 365 tenants through ConnectWise SkyKick?","acceptedAnswer":{"@type":"Answer","text":"Attackers obtained the ConnectWise Cloud Backup application's client assertion credential, which lives in the vendor's own tenant, and used it to sign in to customer Microsoft 365 tenants from the IP 144.172.64.128 instead of normal Azure private IP space. This granted Microsoft Graph access tokens with the app's existing broad permissions over mailboxes, OneDrive, SharePoint, Teams, and directory data, without any action needed from the customer. Security teams tracking vendor credential compromises follow breakdowns like this on daily.dev."}},{"@type":"Question","name":"What persistence technique did attackers use after compromising the ConnectWise Cloud Management Teams app?","acceptedAnswer":{"@type":"Answer","text":"In one tenant, the ConnectWise Cloud Management app for Microsoft Teams (app ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then used a Python script to add new client secrets to an MSP management application and to Huntress's own security platform application, with the new secrets set to expire in 2028. This maps to MITRE ATT\u0026CK technique T1098.001, Account Manipulation: Additional Cloud Credentials. Admins investigating cloud credential persistence techniques reference incident writeups like this on daily.dev."}}]} ```