Stolen ConnectWise app keys signed in to customer Microsoft 365

On October 21, 2026, Microsoft said a China-aligned group it calls Storm-0940 was behind the recent abuse of ConnectWise Cloud Backup, formerly SkyKick. The group did not need each employee’s password. It used application credentials the customers had already approved, and signed in as the app.

If your organization does not use ConnectWise or SkyKick with Microsoft 365, there is no setting to change. If it does, the useful step is to leave the affected app connections off until ConnectWise publishes a formal go-ahead, and to have someone who can read the tenant’s sign-in logs actually read them.

What Microsoft described

Microsoft’s account says that as early as September 2026, Storm-0940 used an open-source penetration-testing framework called ARTEX to automate reconnaissance, password spraying, and abuse of OAuth applications. In several of those operations, Microsoft says, the time from first targeting to privileged cloud access was under three hours. Microsoft assesses that the same actor carried out the ConnectWise compromise. It says the activity did not come from a flaw in Microsoft’s own products.

A user turns on multi-factor authentication for their own login. An application that an admin has already consented to does not go through that prompt. It shows up as the app. Microsoft says Storm-0940 used stolen ConnectWise application credentials that way, from the same network range it had used earlier in October for a password spray. That spray, from October 10 to 14, targeted 327 accounts at eight organizations and produced more than 151,000 failed sign-ins. Microsoft says that spray itself did not succeed: no token was issued and no directory change came from it.

After the app credentials were in hand, Microsoft says the follow-on activity in some customer tenants included Graph reconnaissance, new application credentials, and changes to identities, groups, and privileged roles. Microsoft is explicit that a successful app sign-in does not, by itself, mean mail or files were copied.

ConnectWise’s own advisory went up on October 16. Huntress, which published its own review the same day, said that as of 19:00 UTC on October 16 it had confirmed unauthorized sign-ins in 162 tenants it monitors. Huntress also described Cloud Management apps assigning themselves directory roles in a smaller set of tenants, and said it had not confirmed with ConnectWise whether that role change was the attacker or the vendor’s own automation. Treat the 162 as Huntress’s count of sign-ins, not as a count of mailboxes read.

What to do if you administer the tenant

1. Keep the affected ConnectWise and SkyKick applications disabled until ConnectWise says to restore them. Microsoft’s guidance is to disable the connections, not to delete them in a way that throws away the logs, and to wait for ConnectWise’s restoration steps. Search by application ID, not by the display name, including tenants where the integration was removed but the service principal remains.
2. Review service-principal sign-ins from October 13 onward. Look for Graph activity, new credentials on applications, and role assignments you did not make. Microsoft’s blog includes hunting queries for its own tools. A sign-in by the backup app is not automatically an attack. Unexpected credentials and role changes are the part to escalate.
3. A user’s multi-factor authentication does not cover this path. The fix is on the application: fewer permissions, consent that a second admin has to approve, and an alert when an app grants itself a directory role. Rotating employee passwords does not revoke an application secret that is already in someone else’s hands.
4. Personal Outlook.com and Gmail accounts are not this incident. This is a tenant where an administrator installed the backup product.

Sources

• Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, October 21, 2026
• Huntress, ConnectWise (SkyKick) vendor credentials abused in Microsoft 365 attacks, October 16, 2026