Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…